Merge branch 'master' of github.com:classilla/tenfourfox

Testcases aren't included because they require async/await.

References:
https://bugzilla.mozilla.org/show_bug.cgi?id=1520960 (Allow saving passwords in private windows with a dismissed-by-default doorhanger)
https://hg.mozilla.org/mozilla-central/rev/b4645dc802f9 (Allow login capture from form submissions in private browsing when pref'd on.)
https://hg.mozilla.org/mozilla-central/rev/5656f8b5c547 (Allow login capture from HTTP auth prompts in private browsing when pref'd on.)
https://bugzilla.mozilla.org/show_bug.cgi?id=1660998 (Option to save logins does not keep state in private mode)
https://hg.mozilla.org/mozilla-central/rev/d67d3463b4aa (Don't disable the password manager checkbox in permanent private browsing mode.)

104fx_import_esr102_stspreload.pl

@@ -10,7 +10,7 @@ print <<'EOF';
 /* nsSiteSecurityService.cpp, you shouldn't be #including it.                */
 /*****************************************************************************/
 
-/* imported from ESR68 by TenFourFox conversion script */
+/* imported from ESR102 by TenFourFox conversion script */
 
 #include <stdint.h>
 EOF

104fx_import_esr115_stspreload.pl

@@ -10,7 +10,7 @@ print <<'EOF';
 /* nsSiteSecurityService.cpp, you shouldn't be #including it.                */
 /*****************************************************************************/
 
-/* imported from ESR78 by TenFourFox conversion script */
+/* imported from ESR115 by TenFourFox conversion script */
 
 #include <stdint.h>
 EOF

104fx_import_shavar_cryptominers.pl

@@ -390,7 +390,14 @@ if (!defined($json_ref->{'license'}) ||
 
 select(STDOUT); $|++;
 %dupedupe = ();
-foreach $a (@{ $json_ref->{'categories'}->{'Cryptomining'} }) {
+&emit('Cryptomining');
+&emit('FingerprintingInvasive');
+# considering
+#&emit('Analytics');
+
+sub emit {
+my $cat = shift(@_);
+foreach $a (@{ $json_ref->{'categories'}->{$cat} }) {
 	foreach $b (keys(%{ $a })) {
 		die("illegal newline: $b\n") if ($b =~ /[\r\n]/s);
 		print "// $b\n";
@@ -404,8 +411,15 @@ foreach $a (@{ $json_ref->{'categories'}->{'Cryptomining'} }) {
 				die("illegal quote: $d\n") if ($d =~ /"/);
 				next if ($dupedupe{$d}++);
 
+				# whitelist (with regrets)
+				next if (0 ||
+					$d eq 'ibm.com' ||
+					$d eq 'godaddy.com' ||
+				0);
 				print "        BLOK(\"$d\") ||\n";
+				print "        BLOKD(\".$d\") ||\n";
 			}
 		}
 	}
 }
+}

104fx_upcerts.sh

@@ -10,7 +10,7 @@ endif
 # if we update NSS, we need to remove that patch (TenFourFox issue 512).
 
 set verbose
-set release_url=https://hg.mozilla.org/releases/mozilla-esr78/raw-file/tip/
+set release_url=https://hg.mozilla.org/releases/mozilla-esr115/raw-file/tip/
 
 # self test to ensure certificates and encryption methods are correct
 curl ${release_url}/config/milestone.txt || exit
@@ -18,6 +18,6 @@ curl ${release_url}/config/milestone.txt || exit
 curl ${release_url}/security/manager/ssl/StaticHPKPins.h > security/manager/ssl/StaticHPKPins.h
 curl ${release_url}/security/nss/lib/ckfw/builtins/certdata.txt > security/nss/lib/ckfw/builtins/certdata.txt
 curl ${release_url}/netwerk/dns/effective_tld_names.dat > netwerk/dns/effective_tld_names.dat
-curl ${release_url}/security/manager/ssl/nsSTSPreloadList.inc | perl ./104fx_import_esr78_stspreload.pl > security/manager/ssl/nsSTSPreloadList.inc
+curl ${release_url}/security/manager/ssl/nsSTSPreloadList.inc | perl ./104fx_import_esr102_stspreload.pl > security/manager/ssl/nsSTSPreloadList.inc
 perl ./104fx_import_shavar_cryptominers.pl > caps/shavar-blocklist.h
 

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Merge day clobber
+Rebuild for 115ESR base

README.md

@@ -4,9 +4,9 @@ A fork of Firefox to maintain support for the Power Mac, supporting Mac OS X 10.
 
 This project is specifically for Mac OS X 10.4+. If you're looking for a browser for Mac OS 8.6-10.3, look at our sister project, [Classilla](http://www.classilla.org/).
 
-Our Github project site houses our source code, [documentation wiki](https://github.com/classilla/tenfourfox/wiki) and [issues list](https://github.com/classilla/tenfourfox/issues). For downloads and archived versions, visit our [SourceForge download repository](https://sourceforge.net/projects/tenfourfox/files/). **The most current downloads are always linked on [the main TenFourFox home page](http://www.tenfourfox.com/).**
+**TenFourFox is a "hobby" project: you build it yourself, with no guarantees on updates, update frequency, security or stability.** Our Github project site houses our source code, [documentation wiki](https://github.com/classilla/tenfourfox/wiki) with complete build instructions, and [the current worklist](https://github.com/classilla/tenfourfox/issues). For archived downloads, language packs and contributed tools, visit our [SourceForge download repository](https://sourceforge.net/projects/tenfourfox/files/). **There is no support for any version of TenFourFox.** The current update source is Firefox 115ESR.
 
-**If you are an end-user, or otherwise not an official contributor, do _not_ file issues on Github.** Please visit [our Tenderapp support site](http://tenfourfox.tenderapp.com/) and one of our helpful volunteers will assist. Issues opened by end users may be closed as invalid if they have not been adequately vetted.
+**If you file a Github issue without a patch, or without declaring your intention to file a pull request addressing that issue, it may be summarily closed or deleted at the maintainer's sole discretion.** The issue list is an active worklist, and if no work will occur on an issue, even if the issue is real and verifiable, it will be closed. There are lots of acknowledged deficiencies in TenFourFox and not everyone is going to prioritize a deficiency the way you might. If you are not willing or able to fix your most important issues yourself, you may not want to use this browser.
 
 The `wiki/` branch contains old documentation and release notes from our former Google Code wiki. They are no longer updated or maintained. Take care as links in those documents have probably rotted.
 

browser/app/profile/firefox.js

@@ -51,7 +51,7 @@ pref("extensions.getAddons.recommended.url", "https://services.addons.mozilla.or
 pref("extensions.getAddons.link.url", "https://addons.mozilla.org/%LOCALE%/firefox/");
 
 // Blocklist preferences
-pref("extensions.blocklist.enabled", true);
+pref("extensions.blocklist.enabled", false);
 // OneCRL freshness checking depends on this value, so if you change it,
 // please also update security.onecrl.maximum_staleness_in_seconds.
 pref("extensions.blocklist.interval", 86400);
@@ -86,7 +86,7 @@ pref("browser.dictionaries.download.url", "https://addons.mozilla.org/%LOCALE%/f
 
 // At startup, should we check to see if the installation
 // date is older than some threshold
-pref("app.update.checkInstallTime", true);
+pref("app.update.checkInstallTime", false);
 
 // The number of days a binary is permitted to be old without checking is defined in
 // firefox-branding.js (app.update.checkInstallTime.days)
@@ -122,18 +122,18 @@ pref("app.update.cert.requireBuiltIn", false);
 pref("app.update.cert.checkAttributes", false);
 
 // Whether or not app updates are enabled
-pref("app.update.enabled", true);
+pref("app.update.enabled", false);
 
 // This preference turns on app.update.mode and allows automatic download and
 // install to take place. We use a separate boolean toggle for this to make
 // the UI easier to construct.
-pref("app.update.auto", true);
+pref("app.update.auto", false);
 
 // See chart in nsUpdateService.js source for more details
 pref("app.update.mode", 2);
 
 // If set to true, the Update Service will present no UI for any event.
-pref("app.update.silent", false);
+pref("app.update.silent", true);
 
 // If set to true, the hamburger button will show badges for update events.
 #ifndef RELEASE_BUILD
@@ -177,7 +177,7 @@ pref("app.update.incompatible.mode", 0);
 
 // Whether or not to attempt using the service for updates.
 #ifdef MOZ_MAINTENANCE_SERVICE
-pref("app.update.service.enabled", true);
+pref("app.update.service.enabled", false);
 #endif
 
 // Symmetric (can be overridden by individual extensions) update preferences.
@@ -1622,6 +1622,8 @@ pref("browser.pocket.oAuthConsumerKey", "40249-e88c401e1b1f2242d9e441c4");
 pref("browser.pocket.useLocaleList", true);
 pref("browser.pocket.enabledLocales", "cs de en-GB en-US en-ZA es-ES es-MX fr hu it ja ja-JP-mac ko nl pl pt-BR pt-PT ru zh-CN zh-TW");
 
+pref("signon.privateBrowsingCapture.enabled", true);
+
 pref("view_source.tab", true);
 
 pref("dom.webnotifications.serviceworker.enabled", true);

browser/base/content/baseMenuOverlay.xul

@@ -84,6 +84,7 @@
                   stopaccesskey="&helpSafeMode.stop.accesskey;"
                   stoplabel="&helpSafeMode.stop.label;"
                   oncommand="safeModeRestart();"/>
+#ifdef NO_MORE_OFFICIAL_BUILDS
         <menuseparator id="updateSeparator"/>
 #ifdef XP_MACOSX
 #ifdef MOZ_UPDATER
@@ -92,6 +93,7 @@
                   class="menuitem-iconic"
                   oncommand="checkForUpdates();"/>
 #endif
+#endif
 #endif
         <menuseparator id="aboutSeparator"/>
         <menuitem id="aboutName"

browser/base/content/tab-content.js

@@ -13,6 +13,8 @@ Cu.import("resource://gre/modules/ExtensionContent.jsm");
 
 const g104FxForcePref = "tenfourfox.reader.force-enable"; // TenFourFox issue 583
 const g104FxStickyPref = "tenfourfox.reader.sticky"; // TenFourFox issue 620
+const g104FxAutoPref = "tenfourfox.reader.auto."; // TenFourFox issue 636
+
 Cu.import("resource://gre/modules/Preferences.jsm");
 
 XPCOMUtils.defineLazyModuleGetter(this, "E10SUtils",
@@ -262,6 +264,7 @@ var AboutReaderListener = {
   _articlePromise: null,
   _alwaysAllowReaderMode: true, // TenFourFox issue 583
   _stickyReaderMode: true, // TenFourFox issue 620
+  _currentURISpec: null, // TenFourFox issue 636
 
   init: function() {
     addEventListener("AboutReaderContentLoaded", this, false, true);
@@ -273,12 +276,15 @@ var AboutReaderListener = {
     Services.prefs.addObserver(g104FxForcePref, this, false);
     Services.prefs.addObserver(g104FxStickyPref, this, false);
     Services.obs.addObserver(this, "AboutReader:Ready", false);
+    /* content-document-global-created seems to NS_ASSERT */
+    Services.obs.addObserver(this, "document-element-inserted", false);
   },
 
-  // TenFourFox issue 583
+  // TenFourFox issue 583 + 636
   uninit: function() {
     Services.prefs.removeObserver(g104FxForcePref, this, false);
     Services.obs.removeObserver(this, "AboutReader:Ready");
+    Services.obs.removeObserver(this, "document-element-inserted");
   },
   observe: function(subject, topic, data) { // jshint ignore:line
     if (topic === "nsPref:changed") {
@@ -288,6 +294,54 @@ var AboutReaderListener = {
     if (topic === "AboutReader:Ready") {
       this.stickyReaderLinks();
     }
+    if (topic === "document-element-inserted") { // TenFourFox issue 636
+      this.doAutoReaderView();
+    }
+  },
+
+  // TenFourFox issue 636
+  doAutoReaderView: function() {
+    if (!content || this.isAboutReader)
+      return;
+
+    if (!content.document.documentURI.startsWith("http:") &&
+        !content.document.documentURI.startsWith("https")) {
+      /* could be another about: page, could be ftp, ... */
+      this._currentURISpec = null;
+      return;
+    }
+
+    /* if we ended up back here because we explicitly exited Reader View on
+       the same URL, then honour what the user probably wants. */
+    let loc = content.document.location;
+    if (this._currentURISpec == loc.href) return;
+    this._currentURISpec = loc.href;
+
+    /* process into an nsIURI. this gives us a reliable host *and* spec w/o ref */
+    let uri = Services.io.newURI(loc.href, null, null);
+    if (uri && uri.host && uri.host.length && uri.host.length > 0) {
+      let w = null;
+      try {
+        w = Services.prefs.getCharPref(g104FxAutoPref + uri.host);
+      } catch(e) { }
+      if (w && w.length && w.length > 0) {
+        if (w == "y") {
+          this._currentURISpec = uri.specIgnoringRef; // might change
+          loc.replace("about:reader?url="+encodeURIComponent(uri.specIgnoringRef));
+          return;
+        }
+        if (w == "s") {
+          if (uri.path && uri.path.length && uri.path != "" && uri.path != "/"
+              && !uri.path.startsWith("/?")
+              && !uri.path.toLowerCase().startsWith("/index.")
+             ) {
+            this._currentURISpec = uri.specIgnoringRef; // might change
+            loc.replace("about:reader?url="+encodeURIComponent(uri.specIgnoringRef));
+            return;
+          }
+        }
+      }
+    }
   },
 
   receiveMessage: function(message) {
@@ -342,6 +396,24 @@ var AboutReaderListener = {
         }
         break;
       case "DOMContentLoaded":
+	// Post-load fixups can go here.
+
+	// TenFourFox issue 654: defeat lozad.js lazy image loading.
+	Array.forEach(content.document.getElementsByTagName('img'),
+	function(i) {
+		let j;
+
+		try {
+			// Convert data-src to src.
+			j = i.getAttribute("data-src");
+			if (j) {
+				i.src = j;
+				i.setAttribute("data-loaded") = "true";
+			}
+		} catch(e) { }
+	});
+
+	// Do this last.
         this.updateReaderButton();
         break;
 

browser/base/content/utilityOverlay.js

@@ -670,7 +670,8 @@ function setupCheckForUpdates(checkForUpdates, aStringBundle)
   // Disable the UI if the update enabled pref has been locked by the 
   // administrator or if we cannot update for some other reason
   var canCheckForUpdates = updates.canCheckForUpdates;
-  checkForUpdates.setAttribute("disabled", !canCheckForUpdates);
+  try { checkForUpdates.setAttribute("disabled", !canCheckForUpdates); }
+      catch(e) { return; }
   if (!canCheckForUpdates)
     return; 
 

browser/branding/aurora/pref/firefox-branding.js

@@ -8,7 +8,7 @@ pref("startup.homepage_override_url", "");
 pref("startup.homepage_welcome_url", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "");
 // The time interval between checks for a new version (in seconds)
-pref("app.update.interval", 28800); // 8 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 // 0 means "download everything at once"

browser/branding/nightly/pref/firefox-branding.js

@@ -6,7 +6,7 @@ pref("startup.homepage_override_url","http://www.tenfourfox.com/start/%LOCALE%/%
 pref("startup.homepage_welcome_url","http://www.tenfourfox.com/start/%LOCALE%/%APP%/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "");
 // The time interval between checks for a new version (in seconds)
-pref("app.update.interval", 86400); // 24 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 // 0 means "download everything at once"

browser/branding/official/pref/firefox-branding.js

@@ -6,7 +6,7 @@ pref("startup.homepage_override_url","http://www.tenfourfox.com/start/%LOCALE%/%
 pref("startup.homepage_welcome_url","http://www.tenfourfox.com/start/%LOCALE%/%APP%/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/firstrun/learnmore/");
 // Interval: Time between checks for a new version (in seconds)
-pref("app.update.interval", 43200); // 12 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 pref("app.update.download.backgroundInterval", 60);

browser/branding/unofficial/pref/firefox-branding.js

@@ -6,7 +6,7 @@ pref("startup.homepage_override_url","http://www.tenfourfox.com/start/%LOCALE%/%
 pref("startup.homepage_welcome_url","http://www.tenfourfox.com/start/%LOCALE%/%APP%/%VERSION%/firstrun/");
 pref("startup.homepage_welcome_url.additional", "");
 // The time interval between checks for a new version (in seconds)
-pref("app.update.interval", 86400); // 24 hours
+pref("app.update.interval", 0);
 // The time interval between the downloading of mar file chunks in the
 // background (in seconds)
 pref("app.update.download.backgroundInterval", 60);

browser/components/preferences/in-content/security.js

@@ -99,23 +99,15 @@ var gSecurityPane = {
 
   /**
    * Enables/disables the Exceptions button used to configure sites where
-   * passwords are never saved. When browser is set to start in Private
-   * Browsing mode, the "Remember passwords" UI is useless, so we disable it.
+   * passwords are never saved.
    */
   readSavePasswords: function ()
   {
-    var pref = document.getElementById("signon.rememberSignons");
-    var excepts = document.getElementById("passwordExceptions");
+    var prefValue = document.getElementById("signon.rememberSignons").value;
+    document.getElementById("passwordExceptions").disabled = !prefValue;
 
-    if (PrivateBrowsingUtils.permanentPrivateBrowsing) {
-      document.getElementById("savePasswords").disabled = true;
-      excepts.disabled = true;
-      return false;
-    } else {
-      excepts.disabled = !pref.value;
-      // don't override pref value in UI
-      return undefined;
-    }
+    // don't override pref value in UI
+    return undefined;
   },
 
   /**

browser/components/preferences/in-content/tenfourfox.js

@@ -11,17 +11,44 @@ var gTenFourFoxPane = {
 
   init: function ()
   {
-    function setEventListener(aId, aEventType, aCallback) /* future expansion */
+    function setEventListener(aId, aEventType, aCallback)
     {
       document.getElementById(aId)
               .addEventListener(aEventType, aCallback.bind(gTenFourFoxPane));
     }
 
-    /* setEventListener("historyDontRememberClear", "click", function () {
-      gPrivacyPane.clearPrivateDataNow(true);
-      return false;
-    }); */
+    setEventListener("siteSpecificUAs", "command", gTenFourFoxPane.showSSUAs);
+    setEventListener("autoReaderView", "command", gTenFourFoxPane.showAutoRV);
   },
+
+  showSSUAs: function ()
+  {
+    let bundle = document.getElementById("tenFourFoxBundle");
+    let params = { blockVisible   : true,
+                   sessionVisible : true,
+                   allowVisible   : true,
+                   prefilledHost  : "",
+                   type           : "ssua",
+                   windowTitle    : bundle.getString("TFFsiteSpecificUAs.title"),
+                   introText      : bundle.getString("TFFsiteSpecificUAs.prompt") };
+    gSubDialog.open("chrome://browser/content/preferences/tenfourfox-ssua.xul",
+                    null, params);
+  },
+
+  showAutoRV: function ()
+  {
+    let bundle = document.getElementById("tenFourFoxBundle");
+    let params = { blockVisible   : true,
+                   sessionVisible : true,
+                   allowVisible   : true,
+                   prefilledHost  : "",
+                   type           : "autorv",
+                   windowTitle    : bundle.getString("TFFautoReaderView.title"),
+                   introText      : bundle.getString("TFFautoReaderView.prompt") };
+    gSubDialog.open("chrome://browser/content/preferences/tenfourfox-autorv.xul",
+                    null, params);
+  },
+
   
   // We have to invert the sense for the pdfjs.disabled pref, since true equals DISabled.
 
@@ -37,18 +64,20 @@ var gTenFourFoxPane = {
   },
   
   // Find and set the appropriate UA string based on the UA template.
+  // Keep in sync with tenfourfox-ssua.xul and tenfourfox.xul
   validUA : {
       "fx" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Firefox/52.0",
       "fx60" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Firefox/60.0",
       "fx68" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Firefox/68.0",
       "fx78" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0",
+      "fx91" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0",
+      "fx102" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0",
       "classilla" : "NokiaN90-1/3.0545.5.1 Series60/2.8 Profile/MIDP-2.0 Configuration/CLDC-1.1 (en-US; rv:9.3.3) Clecko/20141026 Classilla/CFM",
       "ie8" : "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)",
       "ie11" : "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko",
       "android" : "Mozilla/5.0 (Linux; Android 8.1.0; Pixel XL Build/OPM1.171019.021) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.109 Mobile Safari/537.36",
       "ipad" : "Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0 Mobile/15D100 Safari/604.1"
   },
-  _prefSvc: Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch),
   readUA: function ()
   {
     var pref = document.getElementById("tenfourfox.ua.template");
@@ -57,7 +86,7 @@ var gTenFourFoxPane = {
     // Synchronize the pref on entry in case it's stale.
     pref = pref.value;
     if (this.validUA[pref]) {
-        this._prefSvc.setCharPref("general.useragent.override", this.validUA[pref]);
+        Services.prefs.setCharPref("general.useragent.override", this.validUA[pref]);
         return pref;
     }
     return "";
@@ -66,10 +95,10 @@ var gTenFourFoxPane = {
   {
     var nupref = document.getElementById("uaBox").value;
     if (this.validUA[nupref]) {
-        this._prefSvc.setCharPref("general.useragent.override", this.validUA[nupref]);
+        Services.prefs.setCharPref("general.useragent.override", this.validUA[nupref]);
         return nupref;
     }
-    this._prefSvc.clearUserPref("general.useragent.override");
+    Services.prefs.clearUserPref("general.useragent.override");
     return "";
   }, 
 };

browser/components/preferences/in-content/tenfourfox.xul

@@ -24,6 +24,9 @@
 
 </preferences>
 
+<stringbundle id="tenFourFoxBundle"
+              src="chrome://browser/locale/TenFourFox.properties"/>
+
 <hbox id="header-tenfourfox"
       class="header"
       hidden="true"
@@ -63,6 +66,8 @@
                 preference="tenfourfox.ua.template">
           <menupopup>
               <menuitem label="&TFFuserAgent.default;" value=""/>
+              <menuitem label="Firefox 102ESR (Intel)" value="fx102"/>
+              <menuitem label="Firefox 91ESR (Intel)" value="fx91"/>
               <menuitem label="Firefox 78ESR (Intel)" value="fx78"/>
               <menuitem label="Firefox 68ESR (Intel)" value="fx68"/>
               <menuitem label="Firefox 60ESR (Intel)" value="fx60"/>
@@ -74,6 +79,8 @@
               <menuitem label="iOS Safari (iPad)" value="ipad"/>
           </menupopup>
       </menulist>
+      <spacer flex="1"/>
+      <button id="siteSpecificUAs" label="&TFFsiteSpecificUAs.label;"/>
   </hbox>
 </groupbox>
 
@@ -85,3 +92,10 @@
                 preference="tenfourfox.adblock.enabled"/>
   </vbox>
 </groupbox>
+
+<groupbox id="autoRVGroup" data-category="paneTenFourFox" hidden="true">
+  <caption><label>&TFFautoReaderView.title;</label></caption>
+  <hbox>
+      <button id="autoReaderView" label="&TFFautoReaderView.label;"/>
+  </hbox>
+</groupbox>

browser/components/preferences/jar.mn

@@ -24,5 +24,9 @@ browser.jar:
     content/browser/preferences/sanitize.js
     content/browser/preferences/selectBookmark.xul
     content/browser/preferences/selectBookmark.js
+    content/browser/preferences/tenfourfox-autorv.xul
+*   content/browser/preferences/tenfourfox-autorv.js
+    content/browser/preferences/tenfourfox-ssua.xul
+*   content/browser/preferences/tenfourfox-ssua.js
     content/browser/preferences/translation.xul
     content/browser/preferences/translation.js

browser/components/preferences/tenfourfox-autorv.js

@@ -0,0 +1,344 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+const AUTORV_PREF_BRANCH = "tenfourfox.reader.auto.";
+
+function AutoRV(domain, mode)
+{
+  this.domain = domain;
+  this.mode = mode;
+}
+
+var gTenFourFoxAutoRVManager = {
+  _type                 : "",
+  _AutoRVs                : [],
+  _AutoRVsToAdd           : new Map(), // also includes changes, necessarily
+  _AutoRVsToDelete        : new Map(),
+  _bundle               : null,
+  _pbundle              : null,
+  _tree                 : null,
+  _prefBranch           : null,
+
+  _allpText             : null,
+  _subpText             : null,
+  _modeToString : function(mode) {
+    if (!this._allpText)
+      this._allpText = document.getElementById("rvmodey").label;
+    if (!this._subpText)
+      this._subpText = document.getElementById("rvmodes").label;
+
+    return (mode == "s") ? this._subpText : this._allpText;
+  },
+
+  _view: {
+    _rowCount: 0,
+    get rowCount()
+    {
+      return this._rowCount;
+    },
+    getCellText: function (aRow, aColumn)
+    {
+      if (aColumn.id == "domainCol")
+        return gTenFourFoxAutoRVManager._AutoRVs[aRow].domain;
+      else if (aColumn.id == "modeCol")
+        return gTenFourFoxAutoRVManager._modeToString(gTenFourFoxAutoRVManager._AutoRVs[aRow].mode);
+      return "";
+    },
+
+    isSeparator: function(aIndex) { return false; },
+    isSorted: function() { return false; },
+    isContainer: function(aIndex) { return false; },
+    setTree: function(aTree){},
+    getImageSrc: function(aRow, aColumn) {},
+    getProgressMode: function(aRow, aColumn) {},
+    getCellValue: function(aRow, aColumn) {},
+    cycleHeader: function(column) {},
+    getRowProperties: function(row){ return ""; },
+    getColumnProperties: function(column){ return ""; },
+    getCellProperties: function(row,column){
+      if (column.element.getAttribute("id") == "domainCol")
+        return "ltr";
+
+      return "";
+    }
+  },
+
+  addAutoRV: function ()
+  {
+    var textbox = document.getElementById("domain");
+    var input_dom = textbox.value.replace(/^\s*/, ""); // trim any leading space
+    input_dom = input_dom.replace(/\s*$/,"");
+    input_dom = input_dom.replace("http://", "");
+    input_dom = input_dom.replace("https://", "");
+    input_dom = input_dom.replace(/\//g, "");
+
+    var modebox = document.getElementById("mode");
+    var mode = modebox.value;
+
+    try {
+      // Block things like hostname:port by making a URL and seeing if it rejects it.
+      let uri = Services.io.newURI("http://"+input_dom+":80/", null, null);
+      if (!uri.host) throw "as if";
+    } catch(ex) {
+      var message = this._pbundle.getString("invalidURI");
+      var title = this._pbundle.getString("invalidURITitle");
+      Services.prompt.alert(window, title, message);
+      return;
+    }
+
+    // check whether the entry already exists, and if not, add it
+    let already = false;
+    for (var i = 0; i < this._AutoRVs.length; ++i) {
+      if (this._AutoRVs[i].domain == input_dom) {
+        already = true;
+        this._AutoRVs[i].mode = mode;
+        this._AutoRVsToAdd.set(input_dom, mode); // can go through same path
+        this._resortAutoRVs();
+        break;
+      }
+    }
+
+    if (!already) {
+      this._AutoRVsToAdd.set(input_dom, mode);
+      this._addAutoRVToList(input_dom, mode);
+      ++this._view._rowCount;
+      this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, 1);
+      this._resortAutoRVs();
+    }
+
+    textbox.value = "";
+    modebox.value = "";
+    textbox.focus();
+
+    // covers a case where the site exists already, so the buttons don't disable
+    this.onHostInput(textbox);
+
+    // enable "remove all" button as needed
+    document.getElementById("removeAllAutoRVs").disabled = this._AutoRVs.length == 0;
+  },
+
+  _removeAutoRV: function(autorv)
+  {
+    for (let i = 0; i < this._AutoRVs.length; ++i) {
+      if (this._AutoRVs[i].domain == autorv.domain) {
+        this._AutoRVs.splice(i, 1);
+        this._view._rowCount--;
+        this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, -1);
+        this._tree.treeBoxObject.invalidate();
+        break;
+      }
+    }
+
+    // If this was added during this session, let's remove
+    // it from the pending adds list to prevent extra work.
+    let isnew = this._AutoRVsToAdd.delete(autorv.domain);
+    if (!isnew) {
+      this._AutoRVsToDelete.set(autorv.domain, autorv);
+    }
+  },
+
+  _resortAutoRVs: function()
+  {
+    gTreeUtils.sort(this._tree, this._view, this._AutoRVs,
+                    this._lastAutoRVsortColumn,
+                    this._AutoRVsComparator,
+                    this._lastAutoRVsortColumn,
+                    !this._lastAutoRVsortAscending); // keep sort direction
+    this._tree.treeBoxObject.invalidate();
+  },
+
+  onHostInput: function ()
+  {
+    let w = document.getElementById("domain").value;
+    let x = document.getElementById("mode").value;
+    document.getElementById("btnAdd").disabled = !w || !x || !w.length || !x.length
+      || w.length == 0 || x.length == 0;
+  },
+
+  onWindowKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_ESCAPE)
+      window.close();
+  },
+
+  onHostKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_RETURN)
+      document.getElementById("btnAdd").click();
+  },
+
+  onLoad: function ()
+  {
+    this._bundle = document.getElementById("tenFourFoxPreferences");
+    this._pbundle = document.getElementById("bundlePreferences");
+    var params = window.arguments[0];
+    this.init(params);
+  },
+
+  init: function (aParams)
+  {
+    if (this._type) {
+      // reusing an open dialog, clear the old observer
+      this.uninit();
+    }
+    this._type = aParams.type;
+    _prefBranch = Services.prefs.getBranch(AUTORV_PREF_BRANCH);
+
+    var AutoRVsText = document.getElementById("autorvText");
+    while (AutoRVsText.hasChildNodes())
+      AutoRVsText.removeChild(AutoRVsText.firstChild);
+    AutoRVsText.appendChild(document.createTextNode(aParams.introText));
+
+    document.title = aParams.windowTitle;
+
+    this.onHostInput();
+
+    let treecols = document.getElementsByTagName("treecols")[0];
+    treecols.addEventListener("click", event => {
+      if (event.target.nodeName != "treecol" || event.button != 0) {
+        return;
+      }
+
+      let sortField = event.target.getAttribute("data-field-name");
+      if (!sortField) {
+        return;
+      }
+
+      gTenFourFoxAutoRVManager.onAutoRVsort(sortField);
+    });
+
+    this._loadAutoRVs();
+    _prefBranch.addObserver("", this._loadAutoRVs, false); // XXX: make this better
+
+    document.getElementById("domain").focus();
+  },
+
+  uninit: function ()
+  {
+    _prefBranch.removeObserver("", this._loadAutoRVs); // XXX
+    this._type = "";
+  },
+
+  onAutoRVselected: function ()
+  {
+    var hasSelection = this._tree.view.selection.count > 0;
+    var hasRows = this._tree.view.rowCount > 0;
+    document.getElementById("removeAutoRV").disabled = !hasRows || !hasSelection;
+    document.getElementById("removeAllAutoRVs").disabled = !hasRows;
+  },
+
+  onAutoRVDeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedAutoRVs = [];
+    gTreeUtils.deleteSelectedItems(this._tree, this._view, this._AutoRVs, removedAutoRVs);
+    for (var i = 0; i < removedAutoRVs.length; ++i) {
+      var p = removedAutoRVs[i];
+      this._removeAutoRV(p);
+    }
+    document.getElementById("removeAutoRV").disabled = !this._AutoRVs.length;
+    document.getElementById("removeAllAutoRVs").disabled = !this._AutoRVs.length;
+  },
+
+  onAllAutoRVsDeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedAutoRVs = [];
+    gTreeUtils.deleteAll(this._tree, this._view, this._AutoRVs, removedAutoRVs);
+    for (var i = 0; i < removedAutoRVs.length; ++i) {
+      var p = removedAutoRVs[i];
+      this._removeAutoRV(p);
+    }
+    document.getElementById("removeAutoRV").disabled = true;
+    document.getElementById("removeAllAutoRVs").disabled = true;
+  },
+
+  onAutoRVKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_DELETE
+#ifdef XP_MACOSX
+        || aEvent.keyCode == KeyEvent.DOM_VK_BACK_SPACE
+#endif
+       )
+      this.onAutoRVDeleted();
+  },
+
+  _lastAutoRVsortColumn: "",
+  _lastAutoRVsortAscending: false,
+  _AutoRVsComparator : function (a, b)
+  {
+    return a.toLowerCase().localeCompare(b.toLowerCase());
+  },
+
+
+  onAutoRVsort: function (aColumn)
+  {
+    this._lastAutoRVsortAscending = gTreeUtils.sort(this._tree,
+                                                        this._view,
+                                                        this._AutoRVs,
+                                                        aColumn,
+                                                        this._AutoRVsComparator,
+                                                        this._lastAutoRVsortColumn,
+                                                        this._lastAutoRVsortAscending);
+    this._lastAutoRVsortColumn = aColumn;
+  },
+
+  onApplyChanges: function()
+  {
+    // Stop observing changes since we are about
+    // to write out the pending adds/deletes and don't need
+    // to update the UI.
+    this.uninit();
+
+    // Create and clear prefs out of whole cloth; don't use the
+    // pref branch because it may not exist yet.
+    for (let i of this._AutoRVsToAdd.keys()) {
+      Services.prefs.setCharPref(AUTORV_PREF_BRANCH+i, this._AutoRVsToAdd.get(i));
+    }
+
+    for (let i of this._AutoRVsToDelete.keys()) {
+      Services.prefs.clearUserPref(AUTORV_PREF_BRANCH+i);
+    }
+
+    window.close();
+  },
+
+  _loadAutoRVs: function ()
+  {
+    this._tree = document.getElementById("AutoRVsTree");
+    this._AutoRVs = [];
+
+    // load AutoRVs into a table
+    let count = 0;
+    let domains = _prefBranch.getChildList("");
+    for (let domain of domains) {
+      this._addAutoRVToList(domain, _prefBranch.getCharPref(domain));
+    }
+
+    this._view._rowCount = this._AutoRVs.length;
+
+    // sort and display the table
+    this._tree.view = this._view;
+    this.onAutoRVsort("domain");
+
+    // disable "remove all" button if there are none
+    document.getElementById("removeAllAutoRVs").disabled = this._AutoRVs.length == 0;
+  },
+
+  _addAutoRVToList: function (domain, mode)
+  {
+    var p = new AutoRV(domain, mode);
+    this._AutoRVs.push(p);
+  },
+
+};
+
+function initWithParams(aParams)
+{
+  gTenFourFoxAutoRVManager.init(aParams);
+}

browser/components/preferences/tenfourfox-autorv.xul

@@ -0,0 +1,111 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 
+<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> 
+
+<!DOCTYPE dialog [
+<!ENTITY % permissionsDTD SYSTEM "chrome://browser/locale/preferences/permissions.dtd" >
+<!ENTITY % tenFourFoxDTD SYSTEM "chrome://browser/locale/TenFourFox.dtd" >
+%permissionsDTD;
+%tenFourFoxDTD;
+]>
+
+<window id="TenFourFoxAutoRVDialog" class="windowDialog"
+        windowtype="Browser:TenFourFoxAutoRV"
+        title="&TFFautoReaderView.title;"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        style="width: &window.width;;"
+        onload="gTenFourFoxAutoRVManager.onLoad();"
+        onunload="gTenFourFoxAutoRVManager.uninit();"
+        persist="screenX screenY width height"
+        onkeypress="gTenFourFoxAutoRVManager.onWindowKeyPress(event);">
+
+  <script src="chrome://global/content/treeUtils.js"/>
+  <script src="chrome://browser/content/preferences/tenfourfox-autorv.js"/>
+  <script src="chrome://browser/content/preferences/in-content/tenfourfox.js"/>
+
+  <stringbundle id="bundlePreferences"
+                src="chrome://browser/locale/preferences/preferences.properties"/>
+  <stringbundle id="tenFourFoxPreferences"
+                src="chrome://browser/locale/TenFourFox.properties"/>
+  <keyset>
+    <key key="&windowClose.key;" modifiers="accel" oncommand="window.close();"/>
+  </keyset>
+
+  <vbox class="contentPane largeDialogContainer" flex="1">
+    <description id="autorvText" control="domain"/>
+    <separator class="thin"/>
+    <grid>
+      <columns>
+        <column/>
+        <column flex="1"/>
+      </columns>
+      <rows>
+        <row align="baseline">
+          <hbox pack="end">
+            <label id="domainLabel" control="domain"
+                   value="&TFFsiteSpecificUAs.domain.l;" accesskey="&address.accesskey;"/>
+          </hbox>
+          <textbox id="domain" flex="1"
+                   oninput="gTenFourFoxAutoRVManager.onHostInput();"
+                   onkeypress="gTenFourFoxAutoRVManager.onHostKeyPress(event);"/>
+        </row>
+        <row align="baseline">
+          <hbox pack="end">
+            <label>&TFFautoReaderView.mode.l;</label>
+          </hbox>
+          <menulist id="mode" crop="end" flex="1"
+                   oncommand="gTenFourFoxAutoRVManager.onHostInput();">
+            <menupopup>
+              <menuitem label="" value=""/>
+              <menuitem label="&TFFautoReaderView.mode.all;" value="y" id="rvmodey"/>
+              <menuitem label="&TFFautoReaderView.mode.sub;" value="s" id="rvmodes"/>
+            </menupopup>
+          </menulist>
+        </row>
+      </rows>
+    </grid>
+    <hbox pack="end">
+      <button id="btnAdd" disabled="true" label="&TFFsiteSpecificUAs.add;" default="true" accesskey="&allow.accesskey;"
+              oncommand="gTenFourFoxAutoRVManager.addAutoRV();"/>
+    </hbox>
+
+    <separator class="thin"/>
+    <tree id="AutoRVsTree" flex="1" style="height: 18em;"
+          hidecolumnpicker="true"
+          onkeypress="gTenFourFoxAutoRVManager.onAutoRVKeyPress(event)"
+          onselect="gTenFourFoxAutoRVManager.onAutoRVselected();">
+      <treecols>
+        <treecol id="domainCol" label="&TFFsiteSpecificUAs.domain;" flex="2"
+                 data-field-name="domain" persist="width"/>
+        <splitter class="tree-splitter"/>
+        <treecol id="modeCol" label="&TFFautoReaderView.mode;" flex="1"
+                 data-field-name="mode" persist="width"/>
+      </treecols>
+      <treechildren/>
+    </tree>
+
+    <hbox class="actionButtons" align="left" flex="1">
+      <button id="removeAutoRV" disabled="true"
+              accesskey="&removepermission.accesskey;"
+              icon="remove" label="&removepermission.label;"
+              oncommand="gTenFourFoxAutoRVManager.onAutoRVDeleted();"/>
+       <button id="removeAllAutoRVs" disabled="true"
+              icon="clear" label="&removeallpermissions.label;"
+              accesskey="&removeallpermissions.accesskey;"
+              oncommand="gTenFourFoxAutoRVManager.onAllAutoRVsDeleted();"/>
+   </hbox>
+    <spacer flex="1"/>
+    <hbox class="actionButtons" align="right" flex="1">
+      <button oncommand="close();" icon="close"
+              label="&button.cancel.label;" accesskey="&button.cancel.accesskey;" />
+      <button id="btnApplyChanges" oncommand="gTenFourFoxAutoRVManager.onApplyChanges();" icon="save"
+              label="&button.ok.label;" accesskey="&button.ok.accesskey;"/>
+    </hbox>
+  </vbox>
+</window>

browser/components/preferences/tenfourfox-ssua.js

@@ -0,0 +1,343 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+const UA_PREF_BRANCH = "general.useragent.override.";
+
+function SSUA(domain, ua)
+{
+  this.domain = domain;
+  this.ua = ua;
+}
+
+var gTenFourFoxSSUAManager = {
+  _type                 : "",
+  _SSUAs                : [],
+  _SSUAsToAdd           : new Map(), // also includes changes, necessarily
+  _SSUAsToDelete        : new Map(),
+  _bundle               : null,
+  _pbundle              : null,
+  _tree                 : null,
+  _prefBranch           : null,
+
+  _view: {
+    _rowCount: 0,
+    get rowCount()
+    {
+      return this._rowCount;
+    },
+    getCellText: function (aRow, aColumn)
+    {
+      if (aColumn.id == "domainCol")
+        return gTenFourFoxSSUAManager._SSUAs[aRow].domain;
+      else if (aColumn.id == "uaCol")
+        return gTenFourFoxSSUAManager._SSUAs[aRow].ua;
+      return "";
+    },
+
+    isSeparator: function(aIndex) { return false; },
+    isSorted: function() { return false; },
+    isContainer: function(aIndex) { return false; },
+    setTree: function(aTree){},
+    getImageSrc: function(aRow, aColumn) {},
+    getProgressMode: function(aRow, aColumn) {},
+    getCellValue: function(aRow, aColumn) {},
+    cycleHeader: function(column) {},
+    getRowProperties: function(row){ return ""; },
+    getColumnProperties: function(column){ return ""; },
+    getCellProperties: function(row,column){
+      if (column.element.getAttribute("id") == "domainCol")
+        return "ltr";
+
+      return "";
+    }
+  },
+
+  addSSUA: function ()
+  {
+    var textbox = document.getElementById("domain");
+    var uabox = document.getElementById("ua");
+    var input_dom = textbox.value.replace(/^\s*/, ""); // trim any leading space
+    input_dom = input_dom.replace(/\s*$/,"");
+    input_dom = input_dom.replace("http://", "");
+    input_dom = input_dom.replace("https://", "");
+    input_dom = input_dom.replace(/\//g, "");
+
+    var ua = uabox.value.replace(/^\s*/, "");
+    ua = ua.replace(/\s*$/, "");
+
+    try {
+      // Block things like hostname:port by making a URL and seeing if it rejects it.
+      let uri = Services.io.newURI("http://"+input_dom+":80/", null, null);
+      if (!uri.host) throw "as if";
+    } catch(ex) {
+      var message = this._pbundle.getString("invalidURI");
+      var title = this._pbundle.getString("invalidURITitle");
+      Services.prompt.alert(window, title, message);
+      return;
+    }
+
+    // check whether the entry already exists, and if not, add it
+    let already = false;
+    for (var i = 0; i < this._SSUAs.length; ++i) {
+      if (this._SSUAs[i].domain == input_dom) {
+        already = true;
+        this._SSUAs[i].ua = ua;
+        this._SSUAsToAdd.set(input_dom, ua); // can go through same path
+        this._resortSSUAs();
+        break;
+      }
+    }
+
+    if (!already) {
+      this._SSUAsToAdd.set(input_dom, ua);
+      this._addSSUAToList(input_dom, ua);
+      ++this._view._rowCount;
+      this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, 1);
+      this._resortSSUAs();
+    }
+
+    textbox.value = "";
+    uabox.value = "";
+    textbox.focus();
+
+    // covers a case where the site exists already, so the buttons don't disable
+    this.onHostInput(textbox);
+
+    // enable "remove all" button as needed
+    document.getElementById("removeAllSSUAs").disabled = this._SSUAs.length == 0;
+  },
+
+  _removeSSUA: function(ssua)
+  {
+    for (let i = 0; i < this._SSUAs.length; ++i) {
+      if (this._SSUAs[i].domain == ssua.domain) {
+        this._SSUAs.splice(i, 1);
+        this._view._rowCount--;
+        this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, -1);
+        this._tree.treeBoxObject.invalidate();
+        break;
+      }
+    }
+
+    // If this was added during this session, let's remove
+    // it from the pending adds list to prevent extra work.
+    let isnew = this._SSUAsToAdd.delete(ssua.domain);
+    if (!isnew) {
+      this._SSUAsToDelete.set(ssua.domain, ssua);
+    }
+  },
+
+  _resortSSUAs: function()
+  {
+    gTreeUtils.sort(this._tree, this._view, this._SSUAs,
+                    this._lastSSUAsortColumn,
+                    this._SSUAsComparator,
+                    this._lastSSUAsortColumn,
+                    !this._lastSSUAsortAscending); // keep sort direction
+    this._tree.treeBoxObject.invalidate();
+  },
+
+  onHostInput: function ()
+  {
+    let w = document.getElementById("domain").value;
+    let x = document.getElementById("ua").value;
+    document.getElementById("btnAdd").disabled = !w || !x || !w.length || !x.length
+      || w.length == 0 || x.length == 0;
+  },
+
+  onWindowKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_ESCAPE)
+      window.close();
+  },
+
+  onHostKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_RETURN)
+      document.getElementById("btnAdd").click();
+  },
+
+  onLoad: function ()
+  {
+    this._bundle = document.getElementById("tenFourFoxPreferences");
+    this._pbundle = document.getElementById("bundlePreferences");
+    var params = window.arguments[0];
+    this.init(params);
+  },
+
+  init: function (aParams)
+  {
+    if (this._type) {
+      // reusing an open dialog, clear the old observer
+      this.uninit();
+    }
+    this._type = aParams.type;
+    _prefBranch = Services.prefs.getBranch(UA_PREF_BRANCH);
+
+    var SSUAsText = document.getElementById("ssuaText");
+    while (SSUAsText.hasChildNodes())
+      SSUAsText.removeChild(SSUAsText.firstChild);
+    SSUAsText.appendChild(document.createTextNode(aParams.introText));
+
+    document.title = aParams.windowTitle;
+
+    this.onHostInput();
+
+    let treecols = document.getElementsByTagName("treecols")[0];
+    treecols.addEventListener("click", event => {
+      if (event.target.nodeName != "treecol" || event.button != 0) {
+        return;
+      }
+
+      let sortField = event.target.getAttribute("data-field-name");
+      if (!sortField) {
+        return;
+      }
+
+      gTenFourFoxSSUAManager.onSSUAsort(sortField);
+    });
+
+    this._loadSSUAs();
+    _prefBranch.addObserver("", this._loadSSUAs, false); // XXX: make this better
+
+    document.getElementById("domain").focus();
+  },
+
+  uninit: function ()
+  {
+    _prefBranch.removeObserver("", this._loadSSUAs); // XXX
+    this._type = "";
+  },
+
+  onSSUAselected: function ()
+  {
+    var hasSelection = this._tree.view.selection.count > 0;
+    var hasRows = this._tree.view.rowCount > 0;
+    document.getElementById("removeSSUA").disabled = !hasRows || !hasSelection;
+    document.getElementById("removeAllSSUAs").disabled = !hasRows;
+  },
+
+  onSSUADeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedSSUAs = [];
+    gTreeUtils.deleteSelectedItems(this._tree, this._view, this._SSUAs, removedSSUAs);
+    for (var i = 0; i < removedSSUAs.length; ++i) {
+      var p = removedSSUAs[i];
+      this._removeSSUA(p);
+    }
+    document.getElementById("removeSSUA").disabled = !this._SSUAs.length;
+    document.getElementById("removeAllSSUAs").disabled = !this._SSUAs.length;
+  },
+
+  onAllSSUAsDeleted: function ()
+  {
+    if (!this._view.rowCount)
+      return;
+    var removedSSUAs = [];
+    gTreeUtils.deleteAll(this._tree, this._view, this._SSUAs, removedSSUAs);
+    for (var i = 0; i < removedSSUAs.length; ++i) {
+      var p = removedSSUAs[i];
+      this._removeSSUA(p);
+    }
+    document.getElementById("removeSSUA").disabled = true;
+    document.getElementById("removeAllSSUAs").disabled = true;
+  },
+
+  onSSUAKeyPress: function (aEvent)
+  {
+    if (aEvent.keyCode == KeyEvent.DOM_VK_DELETE
+#ifdef XP_MACOSX
+        || aEvent.keyCode == KeyEvent.DOM_VK_BACK_SPACE
+#endif
+       )
+      this.onSSUADeleted();
+  },
+
+  _lastSSUAsortColumn: "",
+  _lastSSUAsortAscending: false,
+  _SSUAsComparator : function (a, b)
+  {
+    return a.toLowerCase().localeCompare(b.toLowerCase());
+  },
+
+
+  onSSUAsort: function (aColumn)
+  {
+    this._lastSSUAsortAscending = gTreeUtils.sort(this._tree,
+                                                        this._view,
+                                                        this._SSUAs,
+                                                        aColumn,
+                                                        this._SSUAsComparator,
+                                                        this._lastSSUAsortColumn,
+                                                        this._lastSSUAsortAscending);
+    this._lastSSUAsortColumn = aColumn;
+  },
+
+  onApplyChanges: function()
+  {
+    // Stop observing changes since we are about
+    // to write out the pending adds/deletes and don't need
+    // to update the UI.
+    this.uninit();
+
+    // Create and clear prefs out of whole cloth; don't use the
+    // pref branch because it may not exist yet.
+    for (let i of this._SSUAsToAdd.keys()) {
+      Services.prefs.setCharPref(UA_PREF_BRANCH+i, this._SSUAsToAdd.get(i));
+    }
+
+    for (let i of this._SSUAsToDelete.keys()) {
+      Services.prefs.clearUserPref(UA_PREF_BRANCH+i);
+    }
+
+    window.close();
+  },
+
+  fillUA: function(popup)
+  {
+    if (popup.value == "")
+      document.getElementById("ua").value = "";
+    else
+      document.getElementById("ua").value = gTenFourFoxPane.validUA[popup.value];
+    this.onHostInput();
+  },
+
+  _loadSSUAs: function ()
+  {
+    this._tree = document.getElementById("SSUAsTree");
+    this._SSUAs = [];
+
+    // load SSUAs into a table
+    let count = 0;
+    let domains = _prefBranch.getChildList("");
+    for (let domain of domains) {
+      this._addSSUAToList(domain, _prefBranch.getCharPref(domain));
+    }
+
+    this._view._rowCount = this._SSUAs.length;
+
+    // sort and display the table
+    this._tree.view = this._view;
+    this.onSSUAsort("domain");
+
+    // disable "remove all" button if there are none
+    document.getElementById("removeAllSSUAs").disabled = this._SSUAs.length == 0;
+  },
+
+  _addSSUAToList: function (domain, ua)
+  {
+    var p = new SSUA(domain, ua);
+    this._SSUAs.push(p);
+  },
+
+};
+
+function initWithParams(aParams)
+{
+  gTenFourFoxSSUAManager.init(aParams);
+}

browser/components/preferences/tenfourfox-ssua.xul

@@ -0,0 +1,128 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 
+<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> 
+
+<!DOCTYPE dialog [
+<!ENTITY % permissionsDTD SYSTEM "chrome://browser/locale/preferences/permissions.dtd" >
+<!ENTITY % tenFourFoxDTD SYSTEM "chrome://browser/locale/TenFourFox.dtd" >
+%permissionsDTD;
+%tenFourFoxDTD;
+]>
+
+<window id="TenFourFoxSSUADialog" class="windowDialog"
+        windowtype="Browser:TenFourFoxSSUA"
+        title="&TFFsiteSpecificUAs.title;"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        style="width: &window.width;;"
+        onload="gTenFourFoxSSUAManager.onLoad();"
+        onunload="gTenFourFoxSSUAManager.uninit();"
+        persist="screenX screenY width height"
+        onkeypress="gTenFourFoxSSUAManager.onWindowKeyPress(event);">
+
+  <script src="chrome://global/content/treeUtils.js"/>
+  <script src="chrome://browser/content/preferences/tenfourfox-ssua.js"/>
+  <script src="chrome://browser/content/preferences/in-content/tenfourfox.js"/>
+
+  <stringbundle id="bundlePreferences"
+                src="chrome://browser/locale/preferences/preferences.properties"/>
+  <stringbundle id="tenFourFoxPreferences"
+                src="chrome://browser/locale/TenFourFox.properties"/>
+  <keyset>
+    <key key="&windowClose.key;" modifiers="accel" oncommand="window.close();"/>
+  </keyset>
+
+  <vbox class="contentPane largeDialogContainer" flex="1">
+    <description id="ssuaText" control="domain"/>
+    <separator class="thin"/>
+    <grid>
+      <columns>
+        <column/>
+        <column flex="1"/>
+      </columns>
+      <rows>
+        <row align="baseline">
+          <hbox pack="end">
+            <label id="domainLabel" control="domain"
+                   value="&TFFsiteSpecificUAs.domain.l;" accesskey="&address.accesskey;"/>
+          </hbox>
+          <textbox id="domain" flex="1"
+                   oninput="gTenFourFoxSSUAManager.onHostInput();"
+                   onkeypress="gTenFourFoxSSUAManager.onHostKeyPress(event);"/>
+        </row>
+        <row align="baseline">
+          <hbox pack="end">
+            <label>&TFFsiteSpecificUAs.preua;</label>
+          </hbox>
+          <menulist id="uaBox" crop="end" flex="1"
+                    oncommand="gTenFourFoxSSUAManager.fillUA(event.target);">
+            <menupopup>
+              <menuitem label="" value=""/>
+              <menuitem label="Firefox 102ESR (Intel)" value="fx102"/>
+              <menuitem label="Firefox 91ESR (Intel)" value="fx91"/>
+              <menuitem label="Firefox 78ESR (Intel)" value="fx78"/>
+              <menuitem label="Firefox 68ESR (Intel)" value="fx68"/>
+              <menuitem label="Firefox 60ESR (Intel)" value="fx60"/>
+              <menuitem label="Firefox 52ESR (Intel)" value="fx"/>
+              <menuitem label="Classilla 9.3.x" value="classilla"/>
+              <menuitem label="Internet Explorer 8" value="ie8"/>
+              <menuitem label="Internet Explorer 11" value="ie11"/>
+              <menuitem label="Android Chrome" value="android"/>
+              <menuitem label="iOS Safari (iPad)" value="ipad"/>
+            </menupopup>
+          </menulist>
+        </row>
+        <row align="baseline">
+          <hbox pack="end">
+            <label id="uaLabel" control="ua" value="&TFFsiteSpecificUAs.ua.l;"/>
+          </hbox>
+          <textbox id="ua" flex="1"
+                   oninput="gTenFourFoxSSUAManager.onHostInput();"
+                   onkeypress="gTenFourFoxSSUAManager.onHostKeyPress(event);"/>
+        </row>
+      </rows>
+    </grid>
+    <hbox pack="end">
+      <button id="btnAdd" disabled="true" label="&TFFsiteSpecificUAs.add;" default="true" accesskey="&allow.accesskey;"
+              oncommand="gTenFourFoxSSUAManager.addSSUA();"/>
+    </hbox>
+
+    <separator class="thin"/>
+    <tree id="SSUAsTree" flex="1" style="height: 18em;"
+          hidecolumnpicker="true"
+          onkeypress="gTenFourFoxSSUAManager.onSSUAKeyPress(event)"
+          onselect="gTenFourFoxSSUAManager.onSSUAselected();">
+      <treecols>
+        <treecol id="domainCol" label="&TFFsiteSpecificUAs.domain;" flex="1"
+                 data-field-name="domain" persist="width"/>
+        <splitter class="tree-splitter"/>
+        <treecol id="uaCol" label="&TFFsiteSpecificUAs.ua;" flex="3"
+                 data-field-name="ua" persist="width"/>
+      </treecols>
+      <treechildren/>
+    </tree>
+
+    <hbox class="actionButtons" align="left" flex="1">
+      <button id="removeSSUA" disabled="true"
+              accesskey="&removepermission.accesskey;"
+              icon="remove" label="&removepermission.label;"
+              oncommand="gTenFourFoxSSUAManager.onSSUADeleted();"/>
+       <button id="removeAllSSUAs" disabled="true"
+              icon="clear" label="&removeallpermissions.label;"
+              accesskey="&removeallpermissions.accesskey;"
+              oncommand="gTenFourFoxSSUAManager.onAllSSUAsDeleted();"/>
+   </hbox>
+    <spacer flex="1"/>
+    <hbox class="actionButtons" align="right" flex="1">
+      <button oncommand="close();" icon="close"
+              label="&button.cancel.label;" accesskey="&button.cancel.accesskey;" />
+      <button id="btnApplyChanges" oncommand="gTenFourFoxSSUAManager.onApplyChanges();" icon="save"
+              label="&button.ok.label;" accesskey="&button.ok.accesskey;"/>
+    </hbox>
+  </vbox>
+</window>

browser/config/version.txt

@@ -1 +1 @@
-45.39.2
+45.41.6

browser/config/version_display.txt

@@ -1 +1 @@
-Feature Parity Release 30 (SPR 2)
+Rolling Release

browser/locales/en-US/chrome/browser/TenFourFox.dtd

@@ -11,3 +11,20 @@
 
 <!ENTITY TFFmseMode.title	"MediaSource">
 <!ENTITY TFFmseMode.prompt	"Enable MSE/media quality options (slower, if available)">
+
+<!ENTITY TFFsiteSpecificUAs.label	"Site Specific…">
+<!ENTITY TFFsiteSpecificUAs.title	"Site Specific User Agents">
+<!ENTITY TFFsiteSpecificUAs.add		"Add">
+<!ENTITY TFFsiteSpecificUAs.domain	"Domain">
+<!ENTITY TFFsiteSpecificUAs.domain.l	"Domain:">
+<!ENTITY TFFsiteSpecificUAs.ua		"User agent">
+<!ENTITY TFFsiteSpecificUAs.ua.l	"User agent string:">
+<!ENTITY TFFsiteSpecificUAs.preua	"Common user agents:">
+
+<!ENTITY TFFautoReaderView.label	"Auto Reader View…">
+<!ENTITY TFFautoReaderView.title	"Site Specific Auto Reader View">
+<!-- also uses domain and add from above -->
+<!ENTITY TFFautoReaderView.mode		"Mode">
+<!ENTITY TFFautoReaderView.mode.l	"Mode:">
+<!ENTITY TFFautoReaderView.mode.all	"All pages">
+<!ENTITY TFFautoReaderView.mode.sub	"Only subpages">

browser/locales/en-US/chrome/browser/TenFourFox.properties

@@ -12,3 +12,8 @@ TFFpdfViewMode.prompt.p	= Use built-in PDF viewer (slower but safer)
 TFFmseMode.title.p	= MediaSource
 TFFmseMode.prompt.p	= Enable MSE/media quality options (slower, if available)
 
+TFFsiteSpecificUAs.title	= Site Specific User Agents
+TFFsiteSpecificUAs.prompt	= This is for advanced users to use a custom user agent for particular domains automatically. Enter a domain and a user agent string, or select a predefined one.
+
+TFFautoReaderView.title		= Site Specific Auto Reader View
+TFFautoReaderView.prompt	= Enter domain names that will automatically switch to the simpler Reader View for all pages, or for subpages only.

browser/locales/en-US/chrome/browser/aboutDialog.dtd

@@ -49,7 +49,7 @@
 <!ENTITY helpus.getInvolvedLink     "get involved!">
 <!ENTITY helpus.end                 "">
 
-<!ENTITY copyright.blurb            "Copyright © 2010-2020 Contributors to TenFourFox. All rights reserved.">
+<!ENTITY copyright.blurb            "Copyright © 2010-2023 Contributors to TenFourFox. All rights reserved.">
 
 <!-- LOCALIZATION NOTE (bottomLinks.license): This is a link title that links to about:license. -->
 <!ENTITY bottomLinks.license        "Licensing Information">

caps/nsScriptSecurityManager.cpp

@@ -699,6 +699,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
             ToLowerCase(hostname);
 #define BLOC(q) hostname.EqualsLiteral(q)
 #define BLOCU(q) url.EqualsLiteral(q)
+#define BLOCS(q) (StringBeginsWith(url, NS_LITERAL_CSTRING(q)))
 #define BLOCE(q) (StringEndsWith(url, NS_LITERAL_CSTRING(q)))
 
             if (0 ||
@@ -711,10 +712,12 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
                       BLOCE("/public/scripts/tldr/index.js")
                     ) ||
 #endif // __ppc__
+                    BLOCS("https://developer.mozilla.org/static/js/main.") ||
 
                     0) {
 #undef BLOC
 #undef BLOCU
+#undef BLOCS
 #undef BLOCE
 
 #ifndef DEBUG
@@ -735,6 +738,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
         if (MOZ_LIKELY(NS_SUCCEEDED(targetBaseURI->GetHost(hostname)))) {
             ToLowerCase(hostname);
 #define BLOK(q) hostname.EqualsLiteral(q)
+#define BLOKD(q) (StringEndsWith(hostname, NS_LITERAL_CSTRING(q)))
             if (0 ||
                 // This is used as a data source by a lot of UIs,
                 // so we shouldn't block it (e.g., nytimes).
@@ -885,6 +889,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
                 BLOK("static.yieldmo.com") ||
                 
                 BLOK("ads.rubiconproject.com") ||
+                BLOK("eus.rubiconproject.com") ||
                 BLOK("fastlane.rubiconproject.com") ||
                 BLOK("optimized-by.rubiconproject.com") ||
                 
@@ -1262,9 +1267,14 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
 
                 BLOK("tag.durationmedia.net") ||
 
+                BLOK("www.datadoghq-browser-agent.com") ||
+
+                BLOK("ext.chtbl.com") ||
+
 #include "shavar-blocklist.h"
 
                     0) {
+#undef BLOKD
 #undef BLOK
                 // Yup.
 #ifndef DEBUG

caps/shavar-blocklist.h

@@ -1,105 +1,568 @@
 // a.js
 //    http://zymerget.bid
         BLOK("alflying.date") ||
+        BLOKD(".alflying.date") ||
         BLOK("alflying.win") ||
+        BLOKD(".alflying.win") ||
         BLOK("anybest.site") ||
+        BLOKD(".anybest.site") ||
         BLOK("flightsy.bid") ||
+        BLOKD(".flightsy.bid") ||
         BLOK("flightsy.win") ||
+        BLOKD(".flightsy.win") ||
         BLOK("flightzy.bid") ||
+        BLOKD(".flightzy.bid") ||
         BLOK("flightzy.date") ||
+        BLOKD(".flightzy.date") ||
         BLOK("flightzy.win") ||
+        BLOKD(".flightzy.win") ||
         BLOK("zymerget.bid") ||
+        BLOKD(".zymerget.bid") ||
         BLOK("zymerget.faith") ||
+        BLOKD(".zymerget.faith") ||
 // CashBeet
 //    http://cashbeet.com
         BLOK("cashbeet.com") ||
+        BLOKD(".cashbeet.com") ||
         BLOK("serv1swork.com") ||
+        BLOKD(".serv1swork.com") ||
 // CoinHive
 //    https://coinhive.com
         BLOK("ad-miner.com") ||
+        BLOKD(".ad-miner.com") ||
         BLOK("authedmine.com") ||
+        BLOKD(".authedmine.com") ||
         BLOK("bmst.pw") ||
+        BLOKD(".bmst.pw") ||
         BLOK("cnhv.co") ||
+        BLOKD(".cnhv.co") ||
         BLOK("coin-hive.com") ||
+        BLOKD(".coin-hive.com") ||
         BLOK("coinhive.com") ||
+        BLOKD(".coinhive.com") ||
         BLOK("wsservices.org") ||
+        BLOKD(".wsservices.org") ||
 // CoinPot
 //    http://coinpot.co
         BLOK("coinpot.co") ||
+        BLOKD(".coinpot.co") ||
 // CryptoLoot
 //    https://crypto-loot.com
         BLOK("cryptaloot.pro") ||
+        BLOKD(".cryptaloot.pro") ||
         BLOK("crypto-loot.com") ||
+        BLOKD(".crypto-loot.com") ||
         BLOK("cryptolootminer.com") ||
+        BLOKD(".cryptolootminer.com") ||
         BLOK("flashx.pw") ||
+        BLOKD(".flashx.pw") ||
         BLOK("gitgrub.pro") ||
+        BLOKD(".gitgrub.pro") ||
         BLOK("reauthenticator.com") ||
+        BLOKD(".reauthenticator.com") ||
         BLOK("statdynamic.com") ||
+        BLOKD(".statdynamic.com") ||
         BLOK("webmine.pro") ||
+        BLOKD(".webmine.pro") ||
 // CryptoWebMiner
 //    https://www.crypto-webminer.com
         BLOK("bitcoin-pay.eu") ||
+        BLOKD(".bitcoin-pay.eu") ||
         BLOK("crypto-webminer.com") ||
+        BLOKD(".crypto-webminer.com") ||
         BLOK("ethpocket.de") ||
+        BLOKD(".ethpocket.de") ||
         BLOK("ethtrader.de") ||
+        BLOKD(".ethtrader.de") ||
 // Gridcash
 //    https://www.gridcash.net/
         BLOK("adless.io") ||
+        BLOKD(".adless.io") ||
         BLOK("gridcash.net") ||
+        BLOKD(".gridcash.net") ||
 // JSE
 //    http://jsecoin.com
         BLOK("freecontent.bid") ||
+        BLOKD(".freecontent.bid") ||
         BLOK("freecontent.date") ||
+        BLOKD(".freecontent.date") ||
         BLOK("freecontent.stream") ||
+        BLOKD(".freecontent.stream") ||
         BLOK("hashing.win") ||
+        BLOKD(".hashing.win") ||
         BLOK("hostingcloud.racing") ||
+        BLOKD(".hostingcloud.racing") ||
         BLOK("hostingcloud.science") ||
+        BLOKD(".hostingcloud.science") ||
         BLOK("jsecoin.com") ||
+        BLOKD(".jsecoin.com") ||
 // MinerAlt
 //    http://mineralt.io
         BLOK("1q2w3.website") ||
+        BLOKD(".1q2w3.website") ||
         BLOK("analytics.blue") ||
+        BLOKD(".analytics.blue") ||
         BLOK("aster18cdn.nl") ||
+        BLOKD(".aster18cdn.nl") ||
         BLOK("belicimo.pw") ||
+        BLOKD(".belicimo.pw") ||
         BLOK("besstahete.info") ||
+        BLOKD(".besstahete.info") ||
         BLOK("dinorslick.icu") ||
+        BLOKD(".dinorslick.icu") ||
         BLOK("feesocrald.com") ||
+        BLOKD(".feesocrald.com") ||
         BLOK("gramombird.com") ||
+        BLOKD(".gramombird.com") ||
         BLOK("istlandoll.com") ||
+        BLOKD(".istlandoll.com") ||
         BLOK("mepirtedic.com") ||
+        BLOKD(".mepirtedic.com") ||
         BLOK("mineralt.io") ||
+        BLOKD(".mineralt.io") ||
         BLOK("pampopholf.com") ||
+        BLOKD(".pampopholf.com") ||
         BLOK("tercabilis.info") ||
+        BLOKD(".tercabilis.info") ||
         BLOK("tulip18.com") ||
+        BLOKD(".tulip18.com") ||
         BLOK("vidzi.tv") ||
+        BLOKD(".vidzi.tv") ||
         BLOK("yololike.space") ||
+        BLOKD(".yololike.space") ||
 // Minescripts
 //    http://minescripts.info
         BLOK("minescripts.info") ||
+        BLOKD(".minescripts.info") ||
         BLOK("sslverify.info") ||
+        BLOKD(".sslverify.info") ||
 // MineXMR
 //    http://minexmr.stream
         BLOK("minexmr.stream") ||
+        BLOKD(".minexmr.stream") ||
 // NeroHut
 //    https://nerohut.com
         BLOK("nerohut.com") ||
+        BLOKD(".nerohut.com") ||
         BLOK("nhsrv.cf") ||
+        BLOKD(".nhsrv.cf") ||
 // Service4refresh
 //    https://service4refresh.info
         BLOK("service4refresh.info") ||
+        BLOKD(".service4refresh.info") ||
 // SpareChange
 //    http://sparechange.io
         BLOK("sparechange.io") ||
+        BLOKD(".sparechange.io") ||
 // SwiftMining
 //    https://swiftmining.win/
         BLOK("swiftmining.win") ||
+        BLOKD(".swiftmining.win") ||
 // Webmine
 //    https://webmine.cz/
         BLOK("authedwebmine.cz") ||
+        BLOKD(".authedwebmine.cz") ||
         BLOK("webmine.cz") ||
+        BLOKD(".webmine.cz") ||
 // WebminePool
 //    http://webminepool.com
         BLOK("webminepool.com") ||
+        BLOKD(".webminepool.com") ||
 // Webmining
 //    https://webmining.co/
         BLOK("webmining.co") ||
+        BLOKD(".webmining.co") ||
+// Adbot
+//    https://adbot.tw/
+        BLOK("adbot.tw") ||
+        BLOKD(".adbot.tw") ||
+// AdCash
+//    https://adcash.com
+        BLOK("ufpcdn.com") ||
+        BLOKD(".ufpcdn.com") ||
+// AdMaven
+//    https://ad-maven.com/
+        BLOK("ad-maven.com") ||
+        BLOKD(".ad-maven.com") ||
+        BLOK("wrethicap.info") ||
+        BLOKD(".wrethicap.info") ||
+// Admicro
+//    http://www.admicro.vn/
+        BLOK("admicro.vn") ||
+        BLOKD(".admicro.vn") ||
+        BLOK("vcmedia.vn") ||
+        BLOKD(".vcmedia.vn") ||
+// Adnium
+//    https://adnium.com
+        BLOK("adnium.com") ||
+        BLOKD(".adnium.com") ||
+        BLOK("montwam.top") ||
+        BLOKD(".montwam.top") ||
+// AdScore
+//    http://www.adscoremarketing.com/
+        BLOK("adsco.re") ||
+        BLOKD(".adsco.re") ||
+// AdxSpace
+//    https://adx.space
+        BLOK("00px.net") ||
+        BLOKD(".00px.net") ||
+// AivaLabs
+//    https://aivalabs.com
+        BLOK("aivalabs.com") ||
+        BLOKD(".aivalabs.com") ||
+// AuditedMedia
+//    https://auditedmedia.com/
+        BLOK("aamapi.com") ||
+        BLOKD(".aamapi.com") ||
+        BLOK("aamsitecertifier.com") ||
+        BLOKD(".aamsitecertifier.com") ||
+        BLOK("auditedmedia.com") ||
+        BLOKD(".auditedmedia.com") ||
+// Azet
+//    http://mediaimpact.sk/
+        BLOK("rsz.sk") ||
+        BLOKD(".rsz.sk") ||
+// BetssonPalantir
+//    https://betssonpalantir.com/
+        BLOK("betssonpalantir.com") ||
+        BLOKD(".betssonpalantir.com") ||
+// BitMedia
+//    https://bitmedia.io/
+        BLOK("bitmedia.io") ||
+        BLOKD(".bitmedia.io") ||
+// BlueCava
+//    http://www.bluecava.com/
+        BLOK("bluecava.com") ||
+        BLOKD(".bluecava.com") ||
+// BoostBox
+//    https://www.boostbox.com.br/
+        BLOK("boostbox.com.br") ||
+        BLOKD(".boostbox.com.br") ||
+// Bouncex
+//    https://www.bouncex.com/
+        BLOK("bounceexchange.com") ||
+        BLOKD(".bounceexchange.com") ||
+        BLOK("bouncex.com") ||
+        BLOKD(".bouncex.com") ||
+        BLOK("bouncex.net") ||
+        BLOKD(".bouncex.net") ||
+// Brandcrumb
+//    http://www.brandcrumb.com
+        BLOK("brandcrumb.com") ||
+        BLOKD(".brandcrumb.com") ||
+// BreakTime
+//    https://www.breaktime.com.tw/
+        BLOK("breaktime.com.tw") ||
+        BLOKD(".breaktime.com.tw") ||
+// BrightEdge
+//    http://www.brightedge.com/
+        BLOK("b0e8.com") ||
+        BLOKD(".b0e8.com") ||
+// C3 Metrics
+//    http://c3metrics.com/
+        BLOK("c3metrics.com") ||
+        BLOKD(".c3metrics.com") ||
+        BLOK("c3tag.com") ||
+        BLOKD(".c3tag.com") ||
+// CallSource
+//    https://www.callsource.com/
+        BLOK("leadtrackingdata.com") ||
+        BLOKD(".leadtrackingdata.com") ||
+// CartsGuru
+//    https://carts.guru/
+        BLOK("carts.guru") ||
+        BLOKD(".carts.guru") ||
+// ClearLink
+//    https://www.clearlink.com/
+        BLOK("clearlink.com") ||
+        BLOKD(".clearlink.com") ||
+// Clickayab
+//    http://www.clickyab.com
+        BLOK("clickyab.com") ||
+        BLOKD(".clickyab.com") ||
+// ClickFrog
+//    https://clickfrog.ru/
+        BLOK("bashirian.biz") ||
+        BLOKD(".bashirian.biz") ||
+        BLOK("buckridge.link") ||
+        BLOKD(".buckridge.link") ||
+        BLOK("franecki.net") ||
+        BLOKD(".franecki.net") ||
+        BLOK("quitzon.net") ||
+        BLOKD(".quitzon.net") ||
+        BLOK("reichelcormier.bid") ||
+        BLOKD(".reichelcormier.bid") ||
+        BLOK("wisokykulas.bid") ||
+        BLOKD(".wisokykulas.bid") ||
+// ClickGuard
+//    https://www.clickguard.com/
+        BLOK("clickguard.com") ||
+        BLOKD(".clickguard.com") ||
+// Clixtell
+//    https://www.clixtell.com/
+        BLOK("clixtell.com") ||
+        BLOKD(".clixtell.com") ||
+// Cloudflare
+//    https://cloudflare.com
+        BLOK("hcaptcha.com") ||
+        BLOKD(".hcaptcha.com") ||
+// dmpxs
+//    http://bob.dmpxs.com
+        BLOK("dmpxs.com") ||
+        BLOKD(".dmpxs.com") ||
+// EroAdvertising
+//    http://www.ero-advertising.com/
+        BLOK("ero-advertising.com") ||
+        BLOKD(".ero-advertising.com") ||
+// Foresee
+//    https://www.foresee.com
+        BLOK("answerscloud.com") ||
+        BLOKD(".answerscloud.com") ||
+        BLOK("foresee.com") ||
+        BLOKD(".foresee.com") ||
+// Friends2Follow
+//    https://friends2follow.com/
+        BLOK("antifraudjs.friends2follow.com") ||
+        BLOKD(".antifraudjs.friends2follow.com") ||
+// Gleam
+//    https://gleam.io/
+        BLOK("fraudjs.io") ||
+        BLOKD(".fraudjs.io") ||
+// GrapheneMedia
+//    http://graphenemedia.in/
+        BLOK("graphenedigitalanalytics.in") ||
+        BLOKD(".graphenedigitalanalytics.in") ||
+// HilltopAds
+//    https://hilltopads.com/
+        BLOK("hilltopads.net") ||
+        BLOKD(".hilltopads.net") ||
+// HotelChamp
+//    https://www.hotelchamp.com
+        BLOK("hotelchamp.com") ||
+        BLOKD(".hotelchamp.com") ||
+// HumanSecurity
+//    https://www.humansecurity.com/
+        BLOK("perimeterx.net") ||
+        BLOKD(".perimeterx.net") ||
+// iMedia
+//    http://www.imedia.cz
+        BLOK("imedia.cz") ||
+        BLOKD(".imedia.cz") ||
+// Impact
+//    https://impact.com/
+        BLOK("fqtag.com") ||
+        BLOKD(".fqtag.com") ||
+// Integral Ad Science
+//    https://integralads.com/
+        BLOK("adsafeprotected.com") ||
+        BLOKD(".adsafeprotected.com") ||
+// iShumei
+//    https://www.ishumei.com/
+        BLOK("fengkongcloud.com") ||
+        BLOKD(".fengkongcloud.com") ||
+// IslayTech
+//    http://islay.tech
+        BLOK("islay.tech") ||
+        BLOKD(".islay.tech") ||
+// ismatlab.com
+//    http://ismatlab.com
+        BLOK("ismatlab.com") ||
+        BLOKD(".ismatlab.com") ||
+// Itch
+//    https://itch.io/
+        BLOK("itch.io") ||
+        BLOKD(".itch.io") ||
+// Kitewheel
+//    https://kitewheel.com/
+        BLOK("kitewheel.com") ||
+        BLOKD(".kitewheel.com") ||
+// Konduto
+//    http://konduto.com
+        BLOK("k-analytix.com") ||
+        BLOKD(".k-analytix.com") ||
+        BLOK("konduto.com") ||
+        BLOKD(".konduto.com") ||
+// LeadsHub
+//    https://ztsrv.com/
+        BLOK("ztsrv.com") ||
+        BLOKD(".ztsrv.com") ||
+// lptracker
+//    https://lptracker.io/
+        BLOK("lptracker.io") ||
+        BLOKD(".lptracker.io") ||
+// MaxMind
+//    https://www.maxmind.com/en/home
+        BLOK("maxmind.com") ||
+        BLOKD(".maxmind.com") ||
+        BLOK("mmapiws.com") ||
+        BLOKD(".mmapiws.com") ||
+// Mercadopago
+//    https://www.mercadopago.com/
+        BLOK("mercadopago.com") ||
+        BLOKD(".mercadopago.com") ||
+// Mobials
+//    http://mobials.com
+        BLOK("mobials.com") ||
+        BLOKD(".mobials.com") ||
+// Negishim
+//    http://www.negishim.org
+        BLOK("negishim.org") ||
+        BLOKD(".negishim.org") ||
+// OneAd
+//    https://www.onead.com.tw/
+        BLOK("guoshipartners.com") ||
+        BLOKD(".guoshipartners.com") ||
+        BLOK("onevision.com.tw") ||
+        BLOKD(".onevision.com.tw") ||
+// OnlineMetrix
+//    http://h.online-metrix.net
+        BLOK("online-metrix.net") ||
+        BLOKD(".online-metrix.net") ||
+// Outbrain
+//    http://www.outbrain.com/
+        BLOK("ligatus.com") ||
+        BLOKD(".ligatus.com") ||
+// PartyPoker
+//    https://www.partypoker.com/
+        BLOK("iivt.com") ||
+        BLOKD(".iivt.com") ||
+// Paypal
+//    https://www.paypal.com
+        BLOK("simility.com") ||
+        BLOKD(".simility.com") ||
+// PixAnalytics
+//    https://pixanalytics.com/
+        BLOK("pixanalytics.com") ||
+        BLOKD(".pixanalytics.com") ||
+// Pixlee
+//    https://www.pixlee.com/
+        BLOK("pixlee.com") ||
+        BLOKD(".pixlee.com") ||
+// PPCProtect
+//    https://ppcprotect.com
+        BLOK("ppcprotect.com") ||
+        BLOKD(".ppcprotect.com") ||
+// PrometheusIntelligenceTechnology
+//    https://prometheusintelligencetechnology.com/
+        BLOK("prometheusintelligencetechnology.com") ||
+        BLOKD(".prometheusintelligencetechnology.com") ||
+// Protected Media
+//    http://www.protected.media/
+        BLOK("ad-score.com") ||
+        BLOKD(".ad-score.com") ||
+// Radware
+//    https://www.radware.com/
+        BLOK("perfdrive.com") ||
+        BLOKD(".perfdrive.com") ||
+// RazorPay
+//    https://razorpay.com
+        BLOK("thirdwatch.ai") ||
+        BLOKD(".thirdwatch.ai") ||
+// Rollick
+//    https://gorollick.com
+        BLOK("rollick.io") ||
+        BLOKD(".rollick.io") ||
+// Selectable Media
+//    http://selectablemedia.com/
+        BLOK("selectablemedia.com") ||
+        BLOKD(".selectablemedia.com") ||
+// Semantiqo
+//    http://semantiqo.com/
+        BLOK("semantiqo.com") ||
+        BLOKD(".semantiqo.com") ||
+// SendPulse
+//    https://sendpulse.com/
+        BLOK("sendpulse.com") ||
+        BLOKD(".sendpulse.com") ||
+// ShaftTraffic
+//    https://shafttraffic.com
+        BLOK("libertystmedia.com") ||
+        BLOKD(".libertystmedia.com") ||
+// Shixiseng
+//    https://www.shixiseng.com/
+        BLOK("xiaoyuanzhao.com") ||
+        BLOKD(".xiaoyuanzhao.com") ||
+// Shortest
+//    http://shorte.st/
+        BLOK("shorte.st") ||
+        BLOKD(".shorte.st") ||
+// SiftScience
+//    https://sift.com/
+        BLOK("siftscience.com") ||
+        BLOKD(".siftscience.com") ||
+// Signifyd
+//    https://www.signifyd.com/
+        BLOK("signifyd.com") ||
+        BLOKD(".signifyd.com") ||
+// SmarterClick
+//    https://smarterclick.com/privacy-policy/
+        BLOK("smct.io") ||
+        BLOKD(".smct.io") ||
+// Smi
+//    http://24smi.net
+        BLOK("24smi.net") ||
+        BLOKD(".24smi.net") ||
+// Storeland
+//    https://storeland.ru/
+        BLOK("storeland.ru") ||
+        BLOKD(".storeland.ru") ||
+// Stripchat
+//    https://stripchat.com/
+        BLOK("stripst.com") ||
+        BLOKD(".stripst.com") ||
+// Stripe
+//    https://stripe.com
+        BLOK("stripe.network") ||
+        BLOKD(".stripe.network") ||
+// TechSolutions
+//    https://www.techsolutions.com.tw/
+        BLOK("techsolutions.com.tw") ||
+        BLOKD(".techsolutions.com.tw") ||
+// tongdun.cn
+//    https://www.tongdun.cn/?lan=EN
+        BLOK("fraudmetrix.cn") ||
+        BLOKD(".fraudmetrix.cn") ||
+        BLOK("tongdun.net") ||
+        BLOKD(".tongdun.net") ||
+// Trendemon
+//    https://trendemon.com/
+        BLOK("trendemon.com") ||
+        BLOKD(".trendemon.com") ||
+// Upland
+//    https://uplandsoftware.com/
+        BLOK("leadlander.com") ||
+        BLOKD(".leadlander.com") ||
+        BLOK("sf14g.com") ||
+        BLOKD(".sf14g.com") ||
+// VerticalHealth
+//    https://www.verticalhealth.com/
+        BLOK("verticalhealth.net") ||
+        BLOKD(".verticalhealth.net") ||
+// Warumbistdusoarm
+//    https://warumbistdusoarm.space
+        BLOK("warumbistdusoarm.space") ||
+        BLOKD(".warumbistdusoarm.space") ||
+// Webmecanik
+//    https://www.webmecanik.com/
+        BLOK("webmecanik.com") ||
+        BLOKD(".webmecanik.com") ||
+// WideOrbit
+//    https://www.wideorbit.com/
+        BLOK("dep-x.com") ||
+        BLOKD(".dep-x.com") ||
+// Yandex
+//    http://www.yandex.com/
+        BLOK("mc.yandex.ru") ||
+        BLOKD(".mc.yandex.ru") ||
+// ZafulAffiliate
+//    https://affiliate.zaful.com/
+        BLOK("affasi.com") ||
+        BLOKD(".affasi.com") ||
+        BLOK("gw-ec.com") ||
+        BLOKD(".gw-ec.com") ||
+        BLOK("zaful.com") ||
+        BLOKD(".zaful.com") ||
+// Zip
+//    https://zip.co
+        BLOK("zipmoney.com.au") ||
+        BLOKD(".zipmoney.com.au") ||

config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-45.39.2
+45.41.6

docshell/base/nsDocShell.cpp

@@ -5385,11 +5385,19 @@ nsDocShell::Stop(uint32_t aStopFlags)
   }
 
   if (nsIWebNavigation::STOP_CONTENT & aStopFlags) {
-    // Stop the document loading
+    // Stop the document loading and animations
     if (mContentViewer) {
       nsCOMPtr<nsIContentViewer> cv = mContentViewer;
       cv->Stop();
     }
+  } else if (nsIWebNavigation::STOP_NETWORK & aStopFlags) {
+    // Stop the document loading only
+    if (mContentViewer) {
+      nsCOMPtr<nsIDocument> doc = mContentViewer->GetDocument();
+      if (doc) {
+        doc->StopDocumentLoad();
+      }
+    }
   }
 
   if (nsIWebNavigation::STOP_NETWORK & aStopFlags) {
@@ -9211,7 +9219,11 @@ nsDocShell::SetupNewViewer(nsIContentViewer* aNewViewer)
   mContentViewer->SetNavigationTiming(mTiming);
 
   if (NS_FAILED(mContentViewer->Init(widget, bounds))) {
+    nsCOMPtr<nsIContentViewer> viewer = mContentViewer;
+    viewer->Close(nullptr);
+    viewer->Destroy();
     mContentViewer = nullptr;
+    mCurrentURI = nullptr;
     NS_WARNING("ContentViewer Initialization failed");
     return NS_ERROR_FAILURE;
   }

dom/base/nsHTMLContentSerializer.cpp

@@ -281,7 +281,7 @@ nsHTMLContentSerializer::AppendElementStart(Element* aElement,
   if (ns == kNameSpaceID_XHTML &&
       (name == nsGkAtoms::script ||
        name == nsGkAtoms::style ||
-       name == nsGkAtoms::noscript ||
+       (name == nsGkAtoms::noscript && aElement->OwnerDoc()->IsScriptEnabled()) ||
        name == nsGkAtoms::noframes)) {
     ++mDisableEntityEncoding;
   }
@@ -310,7 +310,7 @@ nsHTMLContentSerializer::AppendElementEnd(Element* aElement,
   if (ns == kNameSpaceID_XHTML &&
       (name == nsGkAtoms::script ||
        name == nsGkAtoms::style ||
-       name == nsGkAtoms::noscript ||
+       (name == nsGkAtoms::noscript && aElement->OwnerDoc()->IsScriptEnabled()) ||
        name == nsGkAtoms::noframes)) {
     --mDisableEntityEncoding;
   }

dom/base/nsStructuredCloneContainer.cpp

@@ -133,6 +133,10 @@ nsStructuredCloneContainer::GetDataAsBase64(nsAString &aOut)
   if (!DataLength()) {
     return NS_ERROR_FAILURE;
   }
+  CheckedInt<nsAutoCString::size_type> sizeCheck(DataLength());
+  if (MOZ_UNLIKELY(!sizeCheck.isValid())) {
+    return NS_ERROR_FAILURE;
+  }
 
   if (HasClonedDOMObjects()) {
     return NS_ERROR_FAILURE;

dom/base/nsTextFragment.cpp

@@ -209,6 +209,11 @@ FirstNon8Bit(const char16_t *str, const char16_t *end)
 bool
 nsTextFragment::SetTo(const char16_t* aBuffer, int32_t aLength, bool aUpdateBidi)
 {
+  if (MOZ_UNLIKELY(aLength < 0 || static_cast<uint32_t>(aLength) >
+                                      NS_MAX_TEXT_FRAGMENT_LENGTH)) {
+    return false;
+  }
+
   ReleaseText();
 
   if (aLength == 0) {
@@ -337,9 +342,16 @@ nsTextFragment::CopyTo(char16_t *aDest, int32_t aOffset, int32_t aCount)
 bool
 nsTextFragment::Append(const char16_t* aBuffer, uint32_t aLength, bool aUpdateBidi)
 {
+  if (!aLength) {
+    return true;
+  }
+
   // This is a common case because some callsites create a textnode
   // with a value by creating the node and then calling AppendData.
   if (mState.mLength == 0) {
+    if (MOZ_UNLIKELY(aLength > INT32_MAX)) {
+      return false;
+    }
     return SetTo(aBuffer, aLength, aUpdateBidi);
   }
 

dom/bindings/ToJSValue.h

@@ -117,7 +117,7 @@ ToJSValue(JSContext* aCx,
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(aArgument));
   return true;
 }
 

dom/canvas/CanvasRenderingContext2D.cpp

@@ -4030,29 +4030,41 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
 
 gfxFontGroup *CanvasRenderingContext2D::GetCurrentFontStyle()
 {
-  // use lazy initilization for the font group since it's rather expensive
-  if (!CurrentState().fontGroup) {
+  // Use lazy (re)initialization for the fontGroup since it's rather expensive.
+
+  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
+  gfxTextPerfMetrics* tp = nullptr;
+  if (presShell && !presShell->IsDestroying()) {
+    tp = presShell->GetPresContext()->GetTextPerfMetrics();
+  }
+
+  // If we have a cached fontGroup, check that it is valid for the current
+  // prescontext; if not, we need to discard and re-create it.
+  RefPtr<gfxFontGroup>& fontGroup = CurrentState().fontGroup;
+  if (fontGroup && fontGroup->GetTextPerfMetrics() != tp)
+    fontGroup = nullptr;
+
+  if (!fontGroup) {
     ErrorResult err;
     NS_NAMED_LITERAL_STRING(kDefaultFontStyle, "10px sans-serif");
     static float kDefaultFontSize = 10.0;
-    nsCOMPtr<nsIPresShell> presShell = GetPresShell();
-    bool fontUpdated = SetFontInternal(kDefaultFontStyle, err);
+    // If the font has already been set, we're re-creating the fontGroup
+    // and should re-use the existing font attribute; if not, we initialize
+    // it to the canvas default.
+    const nsString& currentFont = CurrentState().font;
+    bool fontUpdated = SetFontInternal(
+        currentFont.IsEmpty() ? kDefaultFontStyle : currentFont, err);
     if (err.Failed() || !fontUpdated) {
       err.SuppressException();
       gfxFontStyle style;
       style.size = kDefaultFontSize;
-      gfxTextPerfMetrics* tp = nullptr;
-      if (presShell && !presShell->IsDestroying()) {
-        tp = presShell->GetPresContext()->GetTextPerfMetrics();
-      }
       int32_t perDevPixel, perCSSPixel;
       GetAppUnitsValues(&perDevPixel, &perCSSPixel);
       gfxFloat devToCssSize = gfxFloat(perDevPixel) / gfxFloat(perCSSPixel);
-      CurrentState().fontGroup =
-        gfxPlatform::GetPlatform()->CreateFontGroup(FontFamilyList(eFamily_sans_serif),
+      fontGroup = gfxPlatform::GetPlatform()->CreateFontGroup(FontFamilyList(eFamily_sans_serif),
                                                     &style, tp,
                                                     nullptr, devToCssSize);
-      if (CurrentState().fontGroup) {
+      if (fontGroup) {
         CurrentState().font = kDefaultFontStyle;
       } else {
         NS_ERROR("Default canvas font is invalid");
@@ -4060,7 +4072,7 @@ gfxFontGroup *CanvasRenderingContext2D::GetCurrentFontStyle()
     }
   }
 
-  return CurrentState().fontGroup;
+  return fontGroup;
 }
 
 //
@@ -5217,6 +5229,16 @@ CanvasRenderingContext2D::GetImageData(JSContext* aCx, double aSx,
   return imageData.forget();
 }
 
+static IntRect ClipImageDataTransfer(IntRect& aSrc, const IntPoint& aDestOffset,
+                                     const IntSize& aDestBounds) {
+  IntRect dest = aSrc;
+  dest.SafeMoveBy(aDestOffset);
+  dest = IntRect(IntPoint(0, 0), aDestBounds).SafeIntersect(dest);
+
+  aSrc = aSrc.SafeIntersect(dest - aDestOffset);
+  return aSrc + aDestOffset;
+}
+
 nsresult
 CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
                                             int32_t aX,
@@ -5232,7 +5254,7 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
   MOZ_ASSERT(aWidth && aHeight);
 
   CheckedInt<uint32_t> len = CheckedInt<uint32_t>(aWidth) * aHeight * 4;
-  if (!len.isValid()) {
+  if (!len.isValid() || len.value() > INT32_MAX) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
@@ -5254,8 +5276,9 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
   }
 
   IntRect srcRect(0, 0, mWidth, mHeight);
-  IntRect destRect(aX, aY, aWidth, aHeight);
-  IntRect srcReadRect = srcRect.Intersect(destRect);
+  IntRect dstWriteRect(0, 0, aWidth, aHeight);
+  IntRect srcReadRect = ClipImageDataTransfer(dstWriteRect, IntPoint(aX, aY),
+                                              IntSize(mWidth, mHeight));
   RefPtr<DataSourceSurface> readback;
   DataSourceSurface::MappedSurface rawData;
   if (!srcReadRect.IsEmpty()) {
@@ -5268,9 +5291,6 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
     }
   }
 
-  IntRect dstWriteRect = srcReadRect;
-  dstWriteRect.MoveBy(-aX, -aY);
-
   uint8_t* src;
   uint32_t srcStride;
 
@@ -5455,10 +5475,10 @@ CanvasRenderingContext2D::PutImageData_explicit(int32_t x, int32_t y, uint32_t w
     dirtyRect = imageDataRect;
   }
 
-  dirtyRect.MoveBy(IntPoint(x, y));
-  dirtyRect = IntRect(0, 0, mWidth, mHeight).Intersect(dirtyRect);
-
-  if (dirtyRect.Width() <= 0 || dirtyRect.Height() <= 0) {
+  IntRect srcRect = dirtyRect;
+  dirtyRect = ClipImageDataTransfer(srcRect, IntPoint(x, y),
+                                    IntSize(mWidth, mHeight));
+  if (dirtyRect.IsEmpty()) {
     return NS_OK;
   }
 
@@ -5551,7 +5571,7 @@ CreateImageData(JSContext* cx, CanvasRenderingContext2D* context,
       h = 1;
 
   CheckedInt<uint32_t> len = CheckedInt<uint32_t>(w) * h * 4;
-  if (!len.isValid()) {
+  if (!len.isValid() || len.value() > INT32_MAX) {
     error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }

dom/events/EventListenerManager.cpp

@@ -24,6 +24,7 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/EventTargetBinding.h"
+#include "mozilla/ScopeExit.h"
 #include "mozilla/TimelineConsumers.h"
 #include "mozilla/EventTimelineMarker.h"
 
@@ -712,6 +713,8 @@ EventListenerManager::SetEventHandler(nsIAtom* aName,
                                       bool aPermitUntrustedEvents,
                                       Element* aElement)
 {
+  auto removeEventHandler = MakeScopeExit([&] { RemoveEventHandler(aName, EmptyString()); });
+
   nsCOMPtr<nsIDocument> doc;
   nsCOMPtr<nsIScriptGlobalObject> global =
     GetScriptGlobalAndDocument(getter_AddRefs(doc));
@@ -786,6 +789,8 @@ EventListenerManager::SetEventHandler(nsIAtom* aName,
   NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
   NS_ENSURE_STATE(global->GetGlobalJSObject());
 
+  removeEventHandler.release();
+
   Listener* listener = SetEventHandlerInternal(aName,
                                                EmptyString(),
                                                TypedEventHandler(),

dom/fetch/FetchDriver.cpp

@@ -617,9 +617,12 @@ FetchDriver::OnDataAvailable(nsIRequest* aRequest,
   // NB: This can be called on any thread!  But we're guaranteed that it is
   // called between OnStartRequest and OnStopRequest, so we don't need to worry
   // about races.
+  if (!mResponse) {
+    MOZ_ASSERT(false);
+    return NS_ERROR_UNEXPECTED;
+  }
 
-  uint32_t aRead;
-  MOZ_ASSERT(mResponse);
+  uint32_t aRead = 0;
   MOZ_ASSERT(mPipeOutputStream);
 
   nsresult rv = aInputStream->ReadSegments(NS_CopySegmentToStream,

dom/html/HTMLSharedObjectElement.cpp

@@ -193,7 +193,12 @@ HTMLSharedObjectElement::SetAttr(int32_t aNameSpaceID, nsIAtom *aName,
   // attributes before inserting the node into the document.
   if (aNotify && IsInComposedDoc() && mIsDoneAddingChildren &&
       aNameSpaceID == kNameSpaceID_None && aName == URIAttrName()) {
-    return LoadObject(aNotify, true);
+    nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
+            [self = RefPtr<HTMLSharedObjectElement>(this), aNotify]() {
+              if (self->IsInComposedDoc()) {
+                self->LoadObject(aNotify, true);
+              }
+            }));
   }
 
   return NS_OK;

dom/indexedDB/KeyPath.cpp

@@ -107,7 +107,7 @@ GetJSValFromKeyPathString(JSContext* aCx,
       // step 4 substep 1: check for .length on a String value.
       if (currentVal.isString() && !tokenizer.hasMoreTokens() &&
           token.EqualsLiteral("length") && aOptions == DoNotCreateProperties) {
-        aKeyJSVal->setNumber(double(JS_GetStringLength(currentVal.toString())));
+        aKeyJSVal->setNumber(uint32_t(JS_GetStringLength(currentVal.toString())));
         break;
       }
 

dom/jsurl/nsJSProtocolHandler.cpp

@@ -201,7 +201,7 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel,
     // Sandboxed document check: javascript: URI's are disabled
     // in a sandboxed document unless 'allow-scripts' was specified.
     nsIDocument* doc = aOriginalInnerWindow->GetExtantDoc();
-    if (doc && doc->HasScriptsBlockedBySandbox()) {
+    if (doc && !doc->IsScriptEnabled()) {
         return NS_ERROR_DOM_RETVAL_UNDEFINED;
     }
 

dom/media/ADTSDemuxer.cpp

@@ -852,8 +852,9 @@ ADTSTrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize)
 
   const int64_t streamLen = StreamLength();
   if (mInfo && streamLen > 0) {
+    int64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
     // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
+    aSize = std::min<int64_t>(aSize, max);
   }
 
   uint32_t read = 0;

dom/media/MP3Demuxer.cpp

@@ -655,7 +655,8 @@ MP3TrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize) {
   const int64_t streamLen = StreamLength();
   if (mInfo && streamLen > 0) {
     // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
+    uint64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
+    aSize = std::min<int64_t>(aSize, max);
   }
 
   uint32_t read = 0;

dom/security/nsCSPContext.cpp

@@ -673,32 +673,52 @@ nsCSPContext::logToConsole(const char16_t* aName,
  * Strip URI for reporting according to:
  * http://www.w3.org/TR/CSP/#violation-reports
  *
+ * @param aSelfURI
+ *        The URI of the CSP policy. Used for cross-origin checks.
  * @param aURI
  *        The uri to be stripped for reporting
  * @param aProtectedResourcePrincipal
  *        The loadingPrincipal of the protected resource
  *        which is needed to enforce the SOP.
+ * @param aEffectiveDirective
+ *        The effective directive that triggered this report
  * @return ASCII serialization of the uri to be reported.
  */
 void
-StripURIForReporting(nsIURI* aURI,
+StripURIForReporting(nsIURI* aSelfURI, nsIURI* aURI,
                      nsIPrincipal* aProtectedResourcePrincipal,
+                     const nsAString& aEffectiveDirective,
                      nsACString& outStrippedURI)
 {
   // 1) If the origin of uri is a globally unique identifier (for example,
   // aURI has a scheme of data, blob, or filesystem), then return the
   // ASCII serialization of uri’s scheme.
-  bool isHttp =
-    (NS_SUCCEEDED(aURI->SchemeIs("http", &isHttp)) && isHttp) ||
-    (NS_SUCCEEDED(aURI->SchemeIs("https", &isHttp)) && isHttp);
-  if (!isHttp) {
+  bool isHttpFtpOrWs =
+    (NS_SUCCEEDED(aURI->SchemeIs("https", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("http", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("wss", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("ws", &isHttpFtpOrWs)) && isHttpFtpOrWs) ||
+    (NS_SUCCEEDED(aURI->SchemeIs("ftp", &isHttpFtpOrWs)) && isHttpFtpOrWs);
+  if (!isHttpFtpOrWs) {
     // not strictly spec compliant, but what we really care about is
-    // http/https. If it's not http/https, then treat aURI as if
-    // it's a globally unique identifier and just return the scheme.
+    // http/https and also ftp. If it's not http/https or ftp, then treat aURI
+    // as if it's a globally unique identifier and just return the scheme.
     aURI->GetScheme(outStrippedURI);
     return;
   }
 
+  // For cross-origin URIs in frame-src also strip the path.
+  // This prevents detailed tracking of pages loaded into an iframe
+  // by the embedding page using a report-only policy.
+  if (aEffectiveDirective.EqualsLiteral("frame-src") ||
+      aEffectiveDirective.EqualsLiteral("object-src")) {
+    nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
+    if (NS_FAILED(ssm->CheckSameOriginURI(aSelfURI, aURI, false))) {
+      aURI->GetPrePath(outStrippedURI);
+      return;
+    }
+  }
+
   // 2) If the origin of uri is not the same as the origin of the protected
   // resource, then return the ASCII serialization of uri’s origin.
   bool sameOrigin =
@@ -765,7 +785,8 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
     nsCOMPtr<nsIURI> uri = do_QueryInterface(aBlockedContentSource);
     // could be a string or URI
     if (uri) {
-      StripURIForReporting(uri, mLoadingPrincipal, reportBlockedURI);
+      StripURIForReporting(mSelfURI, uri, mLoadingPrincipal, aViolatedDirective,
+                           reportBlockedURI);
     } else {
       nsCOMPtr<nsISupportsCString> cstr = do_QueryInterface(aBlockedContentSource);
       if (cstr) {
@@ -782,7 +803,8 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
 
   // document-uri
   nsAutoCString reportDocumentURI;
-  StripURIForReporting(mSelfURI, mLoadingPrincipal, reportDocumentURI);
+  StripURIForReporting(mSelfURI, mSelfURI, mLoadingPrincipal,
+                       aViolatedDirective, reportDocumentURI);
   report.mCsp_report.mDocument_uri = NS_ConvertUTF8toUTF16(reportDocumentURI);
 
   // original-policy

dom/workers/ScriptLoader.cpp

@@ -1993,12 +1993,14 @@ void ReportLoadError(JSContext* aCx, nsresult aLoadResult)
 
     case NS_ERROR_FILE_NOT_FOUND:
     case NS_ERROR_NOT_AVAILABLE:
+    case NS_ERROR_CORRUPTED_CONTENT:
       Throw(aCx, NS_ERROR_DOM_NETWORK_ERR);
       break;
 
     case NS_ERROR_MALFORMED_URI:
       aLoadResult = NS_ERROR_DOM_SYNTAX_ERR;
       // fall through
+    case NS_ERROR_DOM_BAD_URI:
     case NS_ERROR_DOM_SECURITY_ERR:
     case NS_ERROR_DOM_SYNTAX_ERR:
       Throw(aCx, aLoadResult);

dom/workers/WorkerPrivate.cpp

@@ -4120,6 +4120,11 @@ WorkerPrivate::Constructor(JSContext* aCx,
     return nullptr;
   }
 
+  // From this point on (worker thread has been started) we
+  // must keep ourself alive. We can now only be cleared by
+  // ClearSelfRef().
+  worker->mSelfRef = worker;
+
   worker->EnableDebugger();
 
   RefPtr<CompileScriptRunnable> compiler =
@@ -4129,8 +4134,6 @@ WorkerPrivate::Constructor(JSContext* aCx,
     return nullptr;
   }
 
-  worker->mSelfRef = worker;
-
   return worker.forget();
 }
 

dom/xslt/xslt/txMozillaXMLOutput.cpp

@@ -236,19 +236,6 @@ txMozillaXMLOutput::endDocument(nsresult aResult)
         }
     }
 
-    if (!mRefreshString.IsEmpty()) {
-        nsPIDOMWindow *win = mDocument->GetWindow();
-        if (win) {
-            nsCOMPtr<nsIRefreshURI> refURI =
-                do_QueryInterface(win->GetDocShell());
-            if (refURI) {
-                refURI->SetupRefreshURIFromHeader(mDocument->GetDocBaseURI(),
-                                                  mDocument->NodePrincipal(),
-                                                  mRefreshString);
-            }
-        }
-    }
-
     if (mNotifier) {
         mNotifier->OnTransformEnd();
     }
@@ -747,30 +734,13 @@ txMozillaXMLOutput::endHTMLElement(nsIContent* aElement)
 
         return NS_OK;
     }
-    else if (mCreatingNewDocument && aElement->IsHTMLElement(nsGkAtoms::meta)) {
-        // handle HTTP-EQUIV data
-        nsAutoString httpEquiv;
-        aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, httpEquiv);
-        if (!httpEquiv.IsEmpty()) {
-            nsAutoString value;
-            aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::content, value);
-            if (!value.IsEmpty()) {
-                nsContentUtils::ASCIIToLower(httpEquiv);
-                nsCOMPtr<nsIAtom> header = do_GetAtom(httpEquiv);
-                processHTTPEquiv(header, value);
-            }
-        }
-    }
-    
+
     return NS_OK;
 }
 
 void txMozillaXMLOutput::processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue)
 {
-    // For now we only handle "refresh". There's a longer list in
-    // HTMLContentSink::ProcessHeaderData
-    if (aHeader == nsGkAtoms::refresh)
-        LossyCopyUTF16toASCII(aValue, mRefreshString);
+    MOZ_CRASH("Don't call processHTTPEquiv, see bug 1746720");
 }
 
 nsresult

dom/xslt/xslt/txMozillaXSLTProcessor.cpp

@@ -237,9 +237,10 @@ txToFragmentHandlerFactory::createHandlerWith(txOutputFormat* aFormat,
 class txVariable : public txIGlobalParameter
 {
 public:
-    explicit txVariable(nsIVariant* aValue) : mValue(aValue)
+    explicit txVariable(nsIVariant* aValue, txAExprResult* aTxValue)
+      : mValue(aValue), mTxValue(aTxValue)
     {
-        NS_ASSERTION(aValue, "missing value");
+        NS_ASSERTION(aValue && aTxValue, "missing value");
     }
     explicit txVariable(txAExprResult* aValue) : mTxValue(aValue)
     {
@@ -247,12 +248,7 @@ public:
     }
     nsresult getValue(txAExprResult** aValue)
     {
-        NS_ASSERTION(mValue || mTxValue, "variablevalue is null");
-
-        if (!mTxValue) {
-            nsresult rv = Convert(mValue, getter_AddRefs(mTxValue));
-            NS_ENSURE_SUCCESS(rv, rv);
-        }
+        NS_ASSERTION(mTxValue, "variablevalue is null");
 
         *aValue = mTxValue;
         NS_ADDREF(*aValue);
@@ -269,11 +265,11 @@ public:
     {
         return mValue;
     }
-    void setValue(nsIVariant* aValue)
+    void setValue(nsIVariant* aValue, txAExprResult* aTxValue)
     {
-        NS_ASSERTION(aValue, "setting variablevalue to null");
+        NS_ASSERTION(aValue && aTxValue, "setting variablevalue to null");
         mValue = aValue;
-        mTxValue = nullptr;
+        mTxValue = aTxValue;
     }
     void setValue(txAExprResult* aValue)
     {
@@ -282,14 +278,14 @@ public:
         mTxValue = aValue;
     }
 
+    static nsresult Convert(nsIVariant* aValue, txAExprResult** aResult);
+
     friend void ImplCycleCollectionUnlink(txVariable& aVariable);
     friend void ImplCycleCollectionTraverse(
         nsCycleCollectionTraversalCallback& aCallback, txVariable& aVariable,
         const char* aName, uint32_t aFlags);
 
 private:
-    static nsresult Convert(nsIVariant *aValue, txAExprResult** aResult);
-
     nsCOMPtr<nsIVariant> mValue;
     RefPtr<txAExprResult> mTxValue;
 };
@@ -949,13 +945,17 @@ txMozillaXSLTProcessor::SetParameter(const nsAString & aNamespaceURI,
     nsCOMPtr<nsIAtom> localName = do_GetAtom(aLocalName);
     txExpandedName varName(nsId, localName);
 
+    RefPtr<txAExprResult> txValue;
+    rv = txVariable::Convert(value, getter_AddRefs(txValue));
+    NS_ENSURE_SUCCESS(rv, rv);
+
     txVariable* var = static_cast<txVariable*>(mVariables.get(varName));
     if (var) {
-        var->setValue(value);
+        var->setValue(value, txValue);
         return NS_OK;
     }
 
-    var = new txVariable(value);
+    var = new txVariable(value, txValue);
     return mVariables.add(varName, var);
 }
 

gfx/2d/BaseRect.h

@@ -118,12 +118,36 @@ struct BaseRect {
     }
     return result;
   }
+  // Gives the same results as Intersect() but handles integer overflow
+  // better. This comes at a tiny cost in performance.
+  // e.g. {INT_MIN, 0, 0, 20} Intersect { 5000, 0, 500, 20 } gives:
+  // {5000, 0, 0, 0}
+  MOZ_WARN_UNUSED_RESULT Sub SafeIntersect(const Sub& aRect) const {
+    Sub result;
+    result.x = std::max<T>(x, aRect.x);
+    result.y = std::max<T>(y, aRect.y);
+    T right = std::min<T>(x + width, aRect.x + aRect.width);
+    T bottom = std::min<T>(y + height, aRect.y + aRect.height);
+    // See bug 1457110, this function expects to -only- size to 0,0 if the
+    // width/height is explicitly negative.
+    if (right < result.x || bottom < result.y) {
+      result.width = 0;
+      result.height = 0;
+    } else {
+      result.width = right - result.x;
+      result.height = bottom - result.y;
+    }
+    return result;
+  }
   // Sets *this to be the rectangle containing the intersection of the points
   // (including edges) of *this and aRect. If there are no points in that
   // intersection, sets *this to be an empty rectangle with x/y set to the std::max
   // of the x/y of *this and aRect.
   //
   // 'this' can be the same object as either aRect1 or aRect2
+  // Note: bug 1457110 changed this due to a regression from bug 1387399,
+  // but we never used that code, and it was subsequently backed out. We have
+  // SafeIntersect only so we can implement bug 1767365.
   bool IntersectRect(const Sub& aRect1, const Sub& aRect2)
   {
     *static_cast<Sub*>(this) = aRect1.Intersect(aRect2);
@@ -209,6 +233,39 @@ struct BaseRect {
   void SizeTo(T aWidth, T aHeight) { width = aWidth; height = aHeight; }
   void SizeTo(const SizeT& aSize) { width = aSize.width; height = aSize.height; }
 
+  // Variant of MoveBy that ensures that even after translation by a point that
+  // the rectangle coordinates will still fit within numeric limits. The origin
+  // and size will be clipped within numeric limits to ensure this.
+  void SafeMoveByX(T aDx) {
+    T x2 = XMost();
+    if (aDx >= T(0)) {
+      T limit = std::numeric_limits<T>::max();
+      x = limit - aDx < x ? limit : x + aDx;
+      width = (limit - aDx < x2 ? limit : x2 + aDx) - x;
+    } else {
+      T limit = std::numeric_limits<T>::min();
+      x = limit - aDx > x ? limit : x + aDx;
+      width = (limit - aDx > x2 ? limit : x2 + aDx) - x;
+    }
+  }
+  void SafeMoveByY(T aDy) {
+    T y2 = YMost();
+    if (aDy >= T(0)) {
+      T limit = std::numeric_limits<T>::max();
+      y = limit - aDy < y ? limit : y + aDy;
+      height = (limit - aDy < y2 ? limit : y2 + aDy) - y;
+    } else {
+      T limit = std::numeric_limits<T>::min();
+      y = limit - aDy > y ? limit : y + aDy;
+      height = (limit - aDy > y2 ? limit : y2 + aDy) - y;
+    }
+  }
+  void SafeMoveBy(T aDx, T aDy) {
+    SafeMoveByX(aDx);
+    SafeMoveByY(aDy);
+  }
+  void SafeMoveBy(const Point& aPoint) { SafeMoveBy(aPoint.x, aPoint.y); }
+
   void Inflate(T aD) { Inflate(aD, aD); }
   void Inflate(T aDx, T aDy)
   {

gfx/2d/DrawTargetCairo.cpp

@@ -262,6 +262,15 @@ cairo_surface_t* GetAsImageSurface(cairo_surface_t* aSurface)
   return nullptr;
 }
 
+// We're creating a subimage from the parent image's data (in aData) without
+// altering that data or its stride. This constrains the values in aRect, and
+// how they're used. Callers must see to it that the parent fully contains the
+// subimage. Here we ensure that no clipping is done in the X dimension at the
+// beginning of any line. (To do otherwise would require creating a copy of
+// aData from parts of every line in aData (from aRect.Y() to aRect.Height()),
+// and setting the copy to a different stride.) A non-zero aRect.X() is used
+// only to specify the subimage's location in its parent (via
+// cairo_surface_set_device_offset()). This change resolves bug 1719215.
 cairo_surface_t* CreateSubImageForData(unsigned char* aData,
                                        const IntRect& aRect,
                                        int aStride,
@@ -271,16 +280,14 @@ cairo_surface_t* CreateSubImageForData(unsigned char* aData,
     gfxWarning() << "DrawTargetCairo.CreateSubImageForData null aData";
     return nullptr;
   }
-  unsigned char *data = aData +
-                        aRect.y * aStride +
-                        aRect.x * BytesPerPixel(aFormat);
-
+  unsigned char* data = aData + aRect.y * aStride;
   cairo_surface_t *image =
     cairo_image_surface_create_for_data(data,
                                         GfxFormatToCairoFormat(aFormat),
                                         aRect.width,
                                         aRect.height,
                                         aStride);
+  // Set the subimage's location in its parent
   cairo_surface_set_device_offset(image, -aRect.x, -aRect.y);
   return image;
 }

gfx/2d/RecordedEvent.h

@@ -412,7 +412,7 @@ private:
   ReferencePtr mScaledFont;
   PatternStorage mPattern;
   DrawOptions mOptions;
-  Glyph *mGlyphs;
+  Glyph *mGlyphs = nullptr;
   uint32_t mNumGlyphs;
 };
 
@@ -746,7 +746,7 @@ private:
   friend class RecordedEvent;
 
   ReferencePtr mRefPtr;
-  uint8_t *mData;
+  uint8_t *mData = nullptr;
   int32_t mStride;
   IntSize mSize;
   SurfaceFormat mFormat;
@@ -846,7 +846,7 @@ private:
   friend class RecordedEvent;
 
   ReferencePtr mRefPtr;
-  GradientStop *mStops;
+  GradientStop *mStops = nullptr;
   uint32_t mNumStops;
   ExtendMode mExtendMode;
   bool mDataOwned;
@@ -907,7 +907,7 @@ public:
   }
 
   RecordedScaledFontCreation(ReferencePtr aRefPtr, ScaledFont *aScaledFont)
-    : RecordedEvent(SCALEDFONTCREATION), mRefPtr(aRefPtr), mData(nullptr)
+    : RecordedEvent(SCALEDFONTCREATION), mRefPtr(aRefPtr)
   {
     aScaledFont->GetFontFileData(&FontDataProc, this);
   }
@@ -928,7 +928,7 @@ private:
   friend class RecordedEvent;
 
   ReferencePtr mRefPtr;
-  uint8_t *mData;
+  uint8_t *mData = nullptr;
   uint32_t mSize;
   Float mGlyphSize;
   uint32_t mIndex;

gfx/cairo/libpixman/src/pixman-trap.c

@@ -74,7 +74,7 @@ pixman_sample_floor_y (pixman_fixed_t y,
 
     if (f < Y_FRAC_FIRST (n))
     {
-	if (pixman_fixed_to_int (i) == 0x8000)
+	if (pixman_fixed_to_int (i) == 0xffff8000)
 	{
 	    f = 0; /* saturate */
 	}

gfx/ots/src/vdmx.cc

@@ -4,18 +4,23 @@
 
 #include "vdmx.h"
 
+#include <set>
+
 // VDMX - Vertical Device Metrics
 // http://www.microsoft.com/typography/otspec/vdmx.htm
 
 namespace ots {
 
+#define TABLE_NAME "VDMX"
+
 bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
   Buffer table(data, length);
+  ots::Font* font = this->GetFont();
 
   if (!table.ReadU16(&this->version) ||
       !table.ReadU16(&this->num_recs) ||
       !table.ReadU16(&this->num_ratios)) {
-    return Error("Failed to read table header");
+    return Drop("Failed to read table header");
   }
 
   if (this->version > 1) {
@@ -30,7 +35,7 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
         !table.ReadU8(&rec.x_ratio) ||
         !table.ReadU8(&rec.y_start_ratio) ||
         !table.ReadU8(&rec.y_end_ratio)) {
-      return Error("Failed to read RatioRange record %d", i);
+      return Drop("Failed to read RatioRange record %d", i);
     }
 
     if (rec.charset > 1) {
@@ -56,17 +61,28 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
 
   this->offsets.reserve(this->num_ratios);
   const size_t current_offset = table.offset();
+  std::set<uint16_t> unique_offsets;
   // current_offset is less than (2 bytes * 3) + (4 bytes * USHRT_MAX) = 256k.
   for (unsigned i = 0; i < this->num_ratios; ++i) {
     uint16_t offset;
     if (!table.ReadU16(&offset)) {
-      return Error("Failed to read ratio offset %d", i);
+      return Drop("Failed to read ratio offset %d", i);
     }
     if (current_offset + offset >= length) {  // thus doesn't overflow.
-      return Error("Bad ratio offset %d for ration %d", offset, i);
+      return Drop("Bad ratio offset %d for ration %d", offset, i);
     }
 
     this->offsets.push_back(offset);
+    unique_offsets.insert(offset);
+  }
+
+  // Check that num_recs is sufficient to provide as many VDMXGroup records
+  // as there are unique offsets; if not, update it (we'll return an error
+  // below if they're not actually present).
+  if (unique_offsets.size() > this->num_recs) {
+    OTS_WARNING("increasing num_recs (%u is too small for %u unique offsets)",
+                this->num_recs, unique_offsets.size());
+    this->num_recs = unique_offsets.size();
   }
 
   this->groups.reserve(this->num_recs);
@@ -75,7 +91,7 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
     if (!table.ReadU16(&group.recs) ||
         !table.ReadU8(&group.startsz) ||
         !table.ReadU8(&group.endsz)) {
-      return Error("Failed to read record header %d", i);
+      return Drop("Failed to read record header %d", i);
     }
     group.entries.reserve(group.recs);
     for (unsigned j = 0; j < group.recs; ++j) {
@@ -83,7 +99,7 @@ bool OpenTypeVDMX::Parse(const uint8_t *data, size_t length) {
       if (!table.ReadU16(&vt.y_pel_height) ||
           !table.ReadS16(&vt.y_max) ||
           !table.ReadS16(&vt.y_min)) {
-        return Error("Failed to read reacord %d group %d", i, j);
+        return Drop("Failed to read record %d group %d", i, j);
       }
       if (vt.y_max < vt.y_min) {
         return Drop("bad y min/max");
@@ -152,4 +168,6 @@ bool OpenTypeVDMX::Serialize(OTSStream *out) {
   return true;
 }
 
+#undef TABLE_NAME
+
 }  // namespace ots

gfx/thebes/gfxPlatformMac.cpp

@@ -297,15 +297,28 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 
                     // Start with leftmost, using hostname as a screen (TenFourFox issue 492).
 
+                    HTTP_OR_HTTPS_SUBDIR("www.tagesschau.de", "/resources/assets/fonts/TheSansC5s");
+
+                    HTTP_OR_HTTPS_SUBDIR("assets.tagesspiegel.de", "/fonts/Abril_Text_");
+                    HTTP_OR_HTTPS_SUBDIR("assets.tagesspiegel.de", "/fonts/franklingothic-");
+
                     HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/ea/notosansjapanese/v6/NotoSansJP-");
                     HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/notosansjp/v14/");
+                    HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/pressstart2p/v9/");
+                    HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/sourceserifpro/v17/");
+                    HTTP_OR_HTTPS_SUBDIR("fonts.gstatic.com", "/s/oswald/v53/");
 
+
+                    HTTP_OR_HTTPS_SUBDIR("www.icloud.com", "/fonts/SFUIText-");
                     HTTP_OR_HTTPS_SUBDIR("www.icloud.com", "/fonts/current/fonts/SFNSText-");
                     HTTP_OR_HTTPS_SUBDIR("www.icloud.com", "/fonts/current/fonts/SFNSDisplay-");
 
+
                     HTTP_OR_HTTPS_SUBDIR("typeface.nyt.com", "/fonts/nyt-cheltenham-");
                     HTTP_OR_HTTPS_SUBDIR("typeface.nytimes.com", "/fonts/nyt-cheltenham-");
 
+                    HTTP_OR_HTTPS_SUBDIR("www.washingtonpost.com", "/wp-stat/assets/fonts/PostoniWide-");
+
                     // Don't cut to SF-Pro-; there are some dingbat fonts that DO work.
                     HTTP_OR_HTTPS_SUBDIR("www.apple.com", "/wss/fonts/SF-Pro-JP/v1/");
                     HTTP_OR_HTTPS_SUBDIR("www.apple.com", "/wss/fonts/SF-Pro-Text/v1/");
@@ -329,8 +342,9 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 
                     HTTP_OR_HTTPS_SUBDIR("www.vetmed.fu-berlin.de", "/assets/default2/NexusSansWeb-P");
 
-                    HTTP_OR_HTTPS_SUBDIR("cdn.theatlantic.com", "/assets/static/a/frontend/dist/theatlantic/fonts/garamond/AGaramondPro");
-                    HTTP_OR_HTTPS_SUBDIR("cdn.theatlantic.com", "/assets/static/a/frontend/dist/theatlantic/fonts/atlantic-serif/Atlantic-Serif");
+                    HTTP_OR_HTTPS_SUBDIR("www.theatlantic.com", "/packages/fonts/garamond/AGaramondPro");
+                    HTTP_OR_HTTPS_SUBDIR("www.theatlantic.com", "/packages/fonts/goldwyn/goldwyn");
+                    HTTP_OR_HTTPS_SUBDIR("www.theatlantic.com", "/packages/fonts/atlantic/Atlantic-Serif");
 
                     HTTP_OR_HTTPS_SUBDIR("www.kulturstiftung-des-bundes.de", "/typo3conf/ext/base_ksb/Resources/Public/");
 
@@ -340,6 +354,8 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 
                     HTTP_OR_HTTPS_SUBDIR("hartzfacts.de", "/google-fonts/s/notoseriftc/v7/");
 
+                    HTTP_OR_HTTPS_SUBDIR("som.yale.edu","/themes/custom/som/fonts/neuehaasunica/NeueHaasUnicaBlack");
+
                     // Check hostname and subpatterns (TenFourFox issue 477).
                     HOST_AND_KEY("www.latimes.com", "/fonts/KisFBDisplay-");
                     HOST_AND_KEY("www.nerdwallet.com", "Gotham-Book--critical");

image/imgLoader.h

@@ -41,34 +41,10 @@ class ImageURL;
 class imgCacheEntry
 {
 public:
+  NS_INLINE_DECL_REFCOUNTING(imgCacheEntry)
+
   imgCacheEntry(imgLoader* loader, imgRequest* request,
                 bool aForcePrincipalCheck);
-  ~imgCacheEntry();
-
-  nsrefcnt AddRef()
-  {
-    NS_PRECONDITION(int32_t(mRefCnt) >= 0, "illegal refcnt");
-    MOZ_ASSERT(_mOwningThread.GetThread() == PR_GetCurrentThread(),
-      "imgCacheEntry addref isn't thread-safe!");
-    ++mRefCnt;
-    NS_LOG_ADDREF(this, mRefCnt, "imgCacheEntry", sizeof(*this));
-    return mRefCnt;
-  }
-
-  nsrefcnt Release()
-  {
-    NS_PRECONDITION(0 != mRefCnt, "dup release");
-    MOZ_ASSERT(_mOwningThread.GetThread() == PR_GetCurrentThread(),
-      "imgCacheEntry release isn't thread-safe!");
-    --mRefCnt;
-    NS_LOG_RELEASE(this, mRefCnt, "imgCacheEntry");
-    if (mRefCnt == 0) {
-      mRefCnt = 1; /* stabilize */
-      delete this;
-      return 0;
-    }
-    return mRefCnt;
-  }
 
   uint32_t GetDataSize() const
   {
@@ -162,11 +138,9 @@ private: // methods
 
   // Private, unimplemented copy constructor.
   imgCacheEntry(const imgCacheEntry&);
+  ~imgCacheEntry();
 
 private: // data
-  nsAutoRefCnt mRefCnt;
-  NS_DECL_OWNINGTHREAD
-
   imgLoader* mLoader;
   RefPtr<imgRequest> mRequest;
   uint32_t mDataSize;

intl/icu/source/data/misc/metaZones.txt

@@ -305,9 +305,7 @@ metaZones:table(nofallback){
             EG{"Africa/Cairo"}
             FI{"Europe/Helsinki"}
             GR{"Europe/Athens"}
-            JO{"Asia/Amman"}
             LB{"Asia/Beirut"}
-            SY{"Asia/Damascus"}
         }
         Europe_Further_Eastern{
             001{"Europe/Minsk"}
@@ -708,9 +706,170 @@ metaZones:table(nofallback){
             001{"Asia/Yerevan"}
         }
         Yukon{
-            001{"America/Yakutat"}
+            001{"America/Whitehorse"}
         }
     }
+    metazoneIds{
+        acre{"Acre"}
+        afce{"Africa_Central"}
+        afea{"Africa_Eastern"}
+        afgh{"Afghanistan"}
+        afso{"Africa_Southern"}
+        afwe{"Africa_Western"}
+        alam{"Almaty"}
+        alas{"Alaska"}
+        amaz{"Amazon"}
+        amce{"America_Central"}
+        amea{"America_Eastern"}
+        ammo{"America_Mountain"}
+        ampa{"America_Pacific"}
+        anad{"Anadyr"}
+        apia{"Apia"}
+        aqta{"Aqtau"}
+        aqto{"Aqtobe"}
+        arab{"Arabian"}
+        arge{"Argentina"}
+        arme{"Armenia"}
+        arwe{"Argentina_Western"}
+        atla{"Atlantic"}
+        auce{"Australia_Central"}
+        aucw{"Australia_CentralWestern"}
+        auea{"Australia_Eastern"}
+        auwe{"Australia_Western"}
+        azer{"Azerbaijan"}
+        azor{"Azores"}
+        bang{"Bangladesh"}
+        bhut{"Bhutan"}
+        boli{"Bolivia"}
+        bras{"Brasilia"}
+        brun{"Brunei"}
+        case{"Casey"}
+        cave{"Cape_Verde"}
+        cham{"Chamorro"}
+        chat{"Chatham"}
+        chil{"Chile"}
+        chin{"China"}
+        choi{"Choibalsan"}
+        chri{"Christmas"}
+        coco{"Cocos"}
+        colo{"Colombia"}
+        cook{"Cook"}
+        cuba{"Cuba"}
+        davi{"Davis"}
+        dumo{"DumontDUrville"}
+        east{"Easter"}
+        eati{"East_Timor"}
+        ecua{"Ecuador"}
+        euce{"Europe_Central"}
+        euea{"Europe_Eastern"}
+        eufe{"Europe_Further_Eastern"}
+        euwe{"Europe_Western"}
+        falk{"Falkland"}
+        fiji{"Fiji"}
+        frgu{"French_Guiana"}
+        frso{"French_Southern"}
+        gala{"Galapagos"}
+        gamb{"Gambier"}
+        geor{"Georgia"}
+        giis{"Gilbert_Islands"}
+        grea{"Greenland_Eastern"}
+        grwe{"Greenland_Western"}
+        guam{"Guam"}
+        gulf{"Gulf"}
+        guya{"Guyana"}
+        haal{"Hawaii_Aleutian"}
+        hoko{"Hong_Kong"}
+        hovd{"Hovd"}
+        ince{"Indonesia_Central"}
+        indi{"India"}
+        indo{"Indochina"}
+        inea{"Indonesia_Eastern"}
+        inoc{"Indian_Ocean"}
+        inwe{"Indonesia_Western"}
+        iran{"Iran"}
+        irku{"Irkutsk"}
+        isra{"Israel"}
+        japa{"Japan"}
+        kaea{"Kazakhstan_Eastern"}
+        kamc{"Kamchatka"}
+        kawe{"Kazakhstan_Western"}
+        kore{"Korea"}
+        kosr{"Kosrae"}
+        kras{"Krasnoyarsk"}
+        kyrg{"Kyrgystan"}
+        lank{"Lanka"}
+        liis{"Line_Islands"}
+        loho{"Lord_Howe"}
+        maca{"Macau"}
+        macq{"Macquarie"}
+        maga{"Magadan"}
+        mais{"Marshall_Islands"}
+        mala{"Malaysia"}
+        mald{"Maldives"}
+        marq{"Marquesas"}
+        maur{"Mauritius"}
+        maws{"Mawson"}
+        meno{"Mexico_Northwest"}
+        mepa{"Mexico_Pacific"}
+        mgmt{"GMT"}
+        mong{"Mongolia"}
+        mosc{"Moscow"}
+        myan{"Myanmar"}
+        naur{"Nauru"}
+        neca{"New_Caledonia"}
+        nepa{"Nepal"}
+        newf{"Newfoundland"}
+        neze{"New_Zealand"}
+        niue{"Niue"}
+        noma{"North_Mariana"}
+        norf{"Norfolk"}
+        noro{"Noronha"}
+        novo{"Novosibirsk"}
+        omsk{"Omsk"}
+        paki{"Pakistan"}
+        pala{"Palau"}
+        pang{"Papua_New_Guinea"}
+        para{"Paraguay"}
+        peru{"Peru"}
+        phil{"Philippines"}
+        phis{"Phoenix_Islands"}
+        pimi{"Pierre_Miquelon"}
+        pitc{"Pitcairn"}
+        pona{"Ponape"}
+        pyon{"Pyongyang"}
+        qyzy{"Qyzylorda"}
+        reun{"Reunion"}
+        roth{"Rothera"}
+        sakh{"Sakhalin"}
+        sama{"Samara"}
+        samo{"Samoa"}
+        seyc{"Seychelles"}
+        sing{"Singapore"}
+        soge{"South_Georgia"}
+        solo{"Solomon"}
+        suri{"Suriname"}
+        syow{"Syowa"}
+        tahi{"Tahiti"}
+        taip{"Taipei"}
+        taji{"Tajikistan"}
+        toke{"Tokelau"}
+        tong{"Tonga"}
+        truk{"Truk"}
+        turk{"Turkmenistan"}
+        tuva{"Tuvalu"}
+        urug{"Uruguay"}
+        uzbe{"Uzbekistan"}
+        vanu{"Vanuatu"}
+        vene{"Venezuela"}
+        vlad{"Vladivostok"}
+        volg{"Volgograd"}
+        vost{"Vostok"}
+        wake{"Wake"}
+        wall{"Wallis"}
+        yaku{"Yakutsk"}
+        yeka{"Yekaterinburg"}
+        yuko{"Yukon"}
+    }
     metazoneInfo{
         "Africa:Abidjan"{
             {
@@ -1132,11 +1291,6 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1983-10-30 11:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 11:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -1499,6 +1653,33 @@ metaZones:table(nofallback){
             {
                 "Mexico_Pacific",
                 "1998-04-05 09:00",
+                "2022-10-30 08:00",
+            }
+            {
+                "America_Central",
+                "2022-10-30 08:00",
+                "9999-12-31 23:59",
+            }
+        }
+        "America:Ciudad_Juarez"{
+            {
+                "America_Central",
+                "1970-01-01 00:00",
+                "1998-04-05 09:00",
+            }
+            {
+                "Mexico_Pacific",
+                "1998-04-05 09:00",
+                "2022-10-30 08:00",
+            }
+            {
+                "America_Central",
+                "2022-10-30 08:00",
+                "2022-11-30 06:00",
+            }
+            {
+                "America_Mountain",
+                "2022-11-30 06:00",
                 "9999-12-31 23:59",
             }
         }
@@ -1552,18 +1733,13 @@ metaZones:table(nofallback){
             }
         }
         "America:Dawson"{
-            {
-                "Yukon",
-                "1970-01-01 00:00",
-                "1973-10-28 09:00",
-            }
             {
                 "America_Pacific",
                 "1973-10-28 09:00",
                 "2020-11-01 07:00",
             }
             {
-                "America_Mountain",
+                "Yukon",
                 "2020-11-01 07:00",
                 "9999-12-31 23:59",
             }
@@ -1894,21 +2070,11 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1980-04-27 10:00",
             }
-            {
-                "Yukon",
-                "1980-04-27 10:00",
-                "1980-10-26 10:00",
-            }
             {
                 "America_Pacific",
                 "1980-10-26 10:00",
                 "1983-10-30 09:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 09:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2169,11 +2335,6 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1983-10-30 12:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 12:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2230,6 +2391,11 @@ metaZones:table(nofallback){
             {
                 "America_Mountain",
                 "1998-04-05 09:00",
+                "2022-10-30 08:00",
+            }
+            {
+                "America_Central",
+                "2022-10-30 08:00",
                 "9999-12-31 23:59",
             }
         }
@@ -2239,14 +2405,9 @@ metaZones:table(nofallback){
             }
         }
         "America:Pangnirtung"{
-            {
-                "Atlantic",
-                "1970-01-01 00:00",
-                "1995-04-02 06:00",
-            }
             {
                 "America_Eastern",
-                "1995-04-02 06:00",
+                "1970-01-01 00:00",
                 "1999-10-31 06:00",
             }
             {
@@ -2447,11 +2608,6 @@ metaZones:table(nofallback){
                 "1970-01-01 00:00",
                 "1983-10-30 09:00",
             }
-            {
-                "Yukon",
-                "1983-10-30 09:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2542,7 +2698,7 @@ metaZones:table(nofallback){
                 "2020-11-01 07:00",
             }
             {
-                "America_Mountain",
+                "Yukon",
                 "2020-11-01 07:00",
                 "9999-12-31 23:59",
             }
@@ -2553,11 +2709,6 @@ metaZones:table(nofallback){
             }
         }
         "America:Yakutat"{
-            {
-                "Yukon",
-                "1970-01-01 00:00",
-                "1983-11-30 09:00",
-            }
             {
                 "Alaska",
                 "1983-11-30 09:00",
@@ -2713,6 +2864,8 @@ metaZones:table(nofallback){
         "Asia:Amman"{
             {
                 "Europe_Eastern",
+                "1970-01-01 00:00",
+                "2022-10-27 22:00",
             }
         }
         "Asia:Anadyr"{
@@ -2900,6 +3053,8 @@ metaZones:table(nofallback){
         "Asia:Damascus"{
             {
                 "Europe_Eastern",
+                "1970-01-01 00:00",
+                "2022-10-27 21:00",
             }
         }
         "Asia:Dhaka"{
@@ -4007,16 +4162,11 @@ metaZones:table(nofallback){
             {
                 "Moscow",
                 "1970-01-01 00:00",
-                "1990-06-30 23:00",
-            }
-            {
-                "Europe_Central",
-                "1990-06-30 23:00",
-                "1991-03-31 02:00",
+                "1990-06-30 22:00",
             }
             {
                 "Europe_Eastern",
-                "1991-03-31 02:00",
+                "1990-06-30 22:00",
                 "9999-12-31 23:59",
             }
         }
@@ -4076,11 +4226,11 @@ metaZones:table(nofallback){
             {
                 "Moscow",
                 "1970-01-01 00:00",
-                "1991-03-30 23:00",
+                "1990-06-30 22:00",
             }
             {
                 "Europe_Eastern",
-                "1991-03-30 23:00",
+                "1990-06-30 22:00",
                 "9999-12-31 23:59",
             }
         }

intl/icu/source/data/misc/timezoneTypes.txt

@@ -5,12 +5,47 @@ timezoneTypes:table(nofallback){
     bcpTypeAlias{
         tz{
             aqams{"nzakl"}
+            aukns{"auhba"}
+            caffs{"cawnp"}
+            camtr{"cator"}
+            canpg{"cator"}
+            capnt{"caiql"}
+            cathu{"cator"}
+            cayzf{"caedm"}
             cnckg{"cnsha"}
             cnhrb{"cnsha"}
             cnkhg{"cnurc"}
+            gaza{"gazastrp"}
+            mxstis{"mxtij"}
+            uaozh{"uaiev"}
+            uauzh{"uaiev"}
+            umjon{"ushnl"}
             usnavajo{"usden"}
         }
     }
+    ianaMap{
+        timezone{
+            "Africa:Asmera"{"Africa/Asmara"}
+            "America:Buenos_Aires"{"America/Argentina/Buenos_Aires"}
+            "America:Catamarca"{"America/Argentina/Catamarca"}
+            "America:Coral_Harbour"{"America/Atikokan"}
+            "America:Cordoba"{"America/Argentina/Cordoba"}
+            "America:Godthab"{"America/Nuuk"}
+            "America:Indianapolis"{"America/Indiana/Indianapolis"}
+            "America:Jujuy"{"America/Argentina/Jujuy"}
+            "America:Louisville"{"America/Kentucky/Louisville"}
+            "America:Mendoza"{"America/Argentina/Mendoza"}
+            "Asia:Calcutta"{"Asia/Kolkata"}
+            "Asia:Katmandu"{"Asia/Kathmandu"}
+            "Asia:Rangoon"{"Asia/Yangon"}
+            "Asia:Saigon"{"Asia/Ho_Chi_Minh"}
+            "Atlantic:Faeroe"{"Atlantic/Faroe"}
+            "Europe:Kiev"{"Europe/Kyiv"}
+            "Pacific:Enderbury"{"Pacific/Kanton"}
+            "Pacific:Ponape"{"Pacific/Pohnpei"}
+            "Pacific:Truk"{"Pacific/Chuuk"}
+        }
+    }
     typeAlias{
         timezone{
             "Africa:Asmara"{"Africa/Asmera"}
@@ -28,11 +63,18 @@ timezoneTypes:table(nofallback){
             "America:Indiana:Indianapolis"{"America/Indianapolis"}
             "America:Kentucky:Louisville"{"America/Louisville"}
             "America:Knox_IN"{"America/Indiana/Knox"}
+            "America:Montreal"{"America/Toronto"}
+            "America:Nipigon"{"America/Toronto"}
             "America:Nuuk"{"America/Godthab"}
+            "America:Pangnirtung"{"America/Iqaluit"}
             "America:Porto_Acre"{"America/Rio_Branco"}
+            "America:Rainy_River"{"America/Winnipeg"}
             "America:Rosario"{"America/Cordoba"}
+            "America:Santa_Isabel"{"America/Tijuana"}
             "America:Shiprock"{"America/Denver"}
+            "America:Thunder_Bay"{"America/Toronto"}
             "America:Virgin"{"America/St_Thomas"}
+            "America:Yellowknife"{"America/Edmonton"}
             "Antarctica:South_Pole"{"Pacific/Auckland"}
             "Asia:Ashkhabad"{"Asia/Ashgabat"}
             "Asia:Chongqing"{"Asia/Shanghai"}
@@ -54,6 +96,7 @@ timezoneTypes:table(nofallback){
             "Atlantic:Jan_Mayen"{"Arctic/Longyearbyen"}
             "Australia:ACT"{"Australia/Sydney"}
             "Australia:Canberra"{"Australia/Sydney"}
+            "Australia:Currie"{"Australia/Hobart"}
             "Australia:LHI"{"Australia/Lord_Howe"}
             "Australia:NSW"{"Australia/Sydney"}
             "Australia:North"{"Australia/Darwin"}
@@ -86,12 +129,17 @@ timezoneTypes:table(nofallback){
             "Etc:Universal"{"Etc/UTC"}
             "Etc:Zulu"{"Etc/UTC"}
             "Europe:Belfast"{"Europe/London"}
+            "Europe:Kyiv"{"Europe/Kiev"}
             "Europe:Nicosia"{"Asia/Nicosia"}
             "Europe:Tiraspol"{"Europe/Chisinau"}
+            "Europe:Uzhgorod"{"Europe/Kiev"}
+            "Europe:Zaporozhye"{"Europe/Kiev"}
             "Mexico:BajaNorte"{"America/Tijuana"}
             "Mexico:BajaSur"{"America/Mazatlan"}
             "Mexico:General"{"America/Mexico_City"}
             "Pacific:Chuuk"{"Pacific/Truk"}
+            "Pacific:Johnston"{"Pacific/Honolulu"}
+            "Pacific:Kanton"{"Pacific/Enderbury"}
             "Pacific:Pohnpei"{"Pacific/Ponape"}
             "Pacific:Samoa"{"Pacific/Pago_Pago"}
             "Pacific:Yap"{"Pacific/Truk"}
@@ -233,6 +281,7 @@ timezoneTypes:table(nofallback){
             "America:Cayman"{"kygec"}
             "America:Chicago"{"uschi"}
             "America:Chihuahua"{"mxchi"}
+            "America:Ciudad_Juarez"{"mxcjs"}
             "America:Coral_Harbour"{"cayzs"}
             "America:Cordoba"{"arcor"}
             "America:Costa_Rica"{"crsjo"}
@@ -298,11 +347,9 @@ timezoneTypes:table(nofallback){
             "America:Moncton"{"camon"}
             "America:Monterrey"{"mxmty"}
             "America:Montevideo"{"uymvd"}
-            "America:Montreal"{"camtr"}
             "America:Montserrat"{"msmni"}
             "America:Nassau"{"bsnas"}
             "America:New_York"{"usnyc"}
-            "America:Nipigon"{"canpg"}
             "America:Nome"{"usome"}
             "America:Noronha"{"brfen"}
             "America:North_Dakota:Beulah"{"usxul"}
@@ -310,7 +357,6 @@ timezoneTypes:table(nofallback){
             "America:North_Dakota:New_Salem"{"usndnsl"}
             "America:Ojinaga"{"mxoji"}
             "America:Panama"{"papty"}
-            "America:Pangnirtung"{"capnt"}
             "America:Paramaribo"{"srpbm"}
             "America:Phoenix"{"usphx"}
             "America:Port-au-Prince"{"htpap"}
@@ -318,13 +364,11 @@ timezoneTypes:table(nofallback){
             "America:Porto_Velho"{"brpvh"}
             "America:Puerto_Rico"{"prsju"}
             "America:Punta_Arenas"{"clpuq"}
-            "America:Rainy_River"{"caffs"}
             "America:Rankin_Inlet"{"cayek"}
             "America:Recife"{"brrec"}
             "America:Regina"{"careg"}
             "America:Resolute"{"careb"}
             "America:Rio_Branco"{"brrbr"}
-            "America:Santa_Isabel"{"mxstis"}
             "America:Santarem"{"brstm"}
             "America:Santiago"{"clscl"}
             "America:Santo_Domingo"{"dosdq"}
@@ -340,7 +384,6 @@ timezoneTypes:table(nofallback){
             "America:Swift_Current"{"cayyn"}
             "America:Tegucigalpa"{"hntgu"}
             "America:Thule"{"glthu"}
-            "America:Thunder_Bay"{"cathu"}
             "America:Tijuana"{"mxtij"}
             "America:Toronto"{"cator"}
             "America:Tortola"{"vgtov"}
@@ -348,7 +391,6 @@ timezoneTypes:table(nofallback){
             "America:Whitehorse"{"cayxy"}
             "America:Winnipeg"{"cawnp"}
             "America:Yakutat"{"usyak"}
-            "America:Yellowknife"{"cayzf"}
             "Antarctica:Casey"{"aqcas"}
             "Antarctica:Davis"{"aqdav"}
             "Antarctica:DumontDUrville"{"aqddu"}
@@ -387,7 +429,7 @@ timezoneTypes:table(nofallback){
             "Asia:Dubai"{"aedxb"}
             "Asia:Dushanbe"{"tjdyu"}
             "Asia:Famagusta"{"cyfmg"}
-            "Asia:Gaza"{"gaza"}
+            "Asia:Gaza"{"gazastrp"}
             "Asia:Hebron"{"hebron"}
             "Asia:Hong_Kong"{"hkhkg"}
             "Asia:Hovd"{"mnhvd"}
@@ -457,7 +499,6 @@ timezoneTypes:table(nofallback){
             "Australia:Adelaide"{"auadl"}
             "Australia:Brisbane"{"aubne"}
             "Australia:Broken_Hill"{"aubhq"}
-            "Australia:Currie"{"aukns"}
             "Australia:Darwin"{"audrw"}
             "Australia:Eucla"{"aueuc"}
             "Australia:Hobart"{"auhba"}
@@ -545,7 +586,6 @@ timezoneTypes:table(nofallback){
             "Europe:Tallinn"{"eetll"}
             "Europe:Tirane"{"altia"}
             "Europe:Ulyanovsk"{"ruuly"}
-            "Europe:Uzhgorod"{"uauzh"}
             "Europe:Vaduz"{"livdz"}
             "Europe:Vatican"{"vavat"}
             "Europe:Vienna"{"atvie"}
@@ -553,7 +593,6 @@ timezoneTypes:table(nofallback){
             "Europe:Volgograd"{"ruvog"}
             "Europe:Warsaw"{"plwaw"}
             "Europe:Zagreb"{"hrzag"}
-            "Europe:Zaporozhye"{"uaozh"}
             "Europe:Zurich"{"chzrh"}
             "Indian:Antananarivo"{"mgtnr"}
             "Indian:Chagos"{"iodga"}
@@ -581,7 +620,6 @@ timezoneTypes:table(nofallback){
             "Pacific:Guadalcanal"{"sbhir"}
             "Pacific:Guam"{"gugum"}
             "Pacific:Honolulu"{"ushnl"}
-            "Pacific:Johnston"{"umjon"}
             "Pacific:Kiritimati"{"kicxi"}
             "Pacific:Kosrae"{"fmksa"}
             "Pacific:Kwajalein"{"mhkwa"}

intl/icu/source/data/misc/windowsZones.txt

@@ -168,7 +168,7 @@ windowsZones:table(nofallback){
             001{"America/Mexico_City"}
             MX{
                 "America/Mexico_City America/Bahia_Banderas America/Merida America/Mo"
-                "nterrey"
+                "nterrey America/Chihuahua "
             }
         }
         "Central Standard Time"{
@@ -177,7 +177,7 @@ windowsZones:table(nofallback){
                 "America/Winnipeg America/Rainy_River America/Rankin_Inlet America/Re"
                 "solute"
             }
-            MX{"America/Matamoros"}
+            MX{"America/Matamoros America/Ojinaga"}
             US{
                 "America/Chicago America/Indiana/Knox America/Indiana/Tell_City Ameri"
                 "ca/Menominee America/North_Dakota/Beulah America/North_Dakota/Center"
@@ -304,6 +304,7 @@ windowsZones:table(nofallback){
             BF{"Africa/Ouagadougou"}
             CI{"Africa/Abidjan"}
             GH{"Africa/Accra"}
+            GL{"America/Danmarkshavn"}
             GM{"Africa/Banjul"}
             GN{"Africa/Conakry"}
             GW{"Africa/Bissau"}
@@ -397,8 +398,8 @@ windowsZones:table(nofallback){
             MA{"Africa/Casablanca"}
         }
         "Mountain Standard Time (Mexico)"{
-            001{"America/Chihuahua"}
-            MX{"America/Chihuahua America/Mazatlan"}
+            001{"America/Mazatlan"}
+            MX{"America/Mazatlan"}
         }
         "Mountain Standard Time"{
             001{"America/Denver"}
@@ -406,7 +407,7 @@ windowsZones:table(nofallback){
                 "America/Edmonton America/Cambridge_Bay America/Inuvik America/Yellow"
                 "knife"
             }
-            MX{"America/Ojinaga"}
+            MX{"America/Ciudad_Juarez"}
             US{"America/Denver America/Boise"}
             ZZ{"MST7MDT"}
         }
@@ -609,13 +610,16 @@ windowsZones:table(nofallback){
             MW{"Africa/Blantyre"}
             MZ{"Africa/Maputo"}
             RW{"Africa/Kigali"}
-            SS{"Africa/Juba"}
             SZ{"Africa/Mbabane"}
             ZA{"Africa/Johannesburg"}
             ZM{"Africa/Lusaka"}
             ZW{"Africa/Harare"}
             ZZ{"Etc/GMT-2"}
         }
+        "South Sudan Standard Time"{
+            001{"Africa/Juba"}
+            SS{"Africa/Juba"}
+        }
         "Sri Lanka Standard Time"{
             001{"Asia/Colombo"}
             LK{"Asia/Colombo"}
@@ -674,14 +678,14 @@ windowsZones:table(nofallback){
         }
         "US Mountain Standard Time"{
             001{"America/Phoenix"}
+            CA{"America/Creston America/Dawson_Creek America/Fort_Nelson"}
             MX{"America/Hermosillo"}
             US{"America/Phoenix"}
             ZZ{"Etc/GMT+7"}
         }
         "UTC"{
-            001{"Etc/GMT"}
-            GL{"America/Danmarkshavn"}
-            ZZ{"Etc/GMT Etc/UTC"}
+            001{"Etc/UTC"}
+            ZZ{"Etc/UTC Etc/GMT"}
         }
         "UTC+12"{
             001{"Etc/GMT-12"}
@@ -812,10 +816,7 @@ windowsZones:table(nofallback){
         }
         "Yukon Standard Time"{
             001{"America/Whitehorse"}
-            CA{
-                "America/Whitehorse America/Creston America/Dawson America/Dawson_Cre"
-                "ek America/Fort_Nelson"
-            }
+            CA{"America/Whitehorse America/Dawson"}
         }
     }
 }

js/src/jit-test/tests/errors/bug1810711.js

@@ -0,0 +1,13 @@
+var g = newGlobal({newCompartment: true});
+
+try {
+  undef()
+} catch (err) {
+  const handler = { "getPrototypeOf": (x) => () => x };
+  const proxy = new g.Proxy(err, handler);
+  try {
+    proxy.stack
+/* odds are we weren't exploitable because we don't support pure catch,
+   but now it's not a problem */
+  } catch(e) {}
+}

js/src/jit-test/tests/ion/bug1814899.js

@@ -0,0 +1,23 @@
+function bar(x) {
+  with ({}) {}
+  switch (x) {
+  case 1:
+    foo(2);
+    break;
+  case 2:
+    gczeal(14, 1);
+    break;
+  }
+  return "a sufficiently long string";
+}
+
+function foo(x) {
+  for (var s in bar(x)) { gczeal(0); }
+}
+
+with ({}) {}
+for (var i = 0; i < 100; i++) {
+  foo(0);
+}
+foo(1);
+

js/src/jit/InstructionReordering.cpp

@@ -130,6 +130,8 @@ jit::ReorderInstructions(MIRGenerator* mir, MIRGraph& graph)
                 MInstruction* prev = *riter;
                 if (prev->isInterruptCheck())
                     break;
+                if (prev->isSetInitializedLength())
+                    break;
 
                 // The instruction can't be moved before any of its uses.
                 bool isUse = false;

js/src/jit/JitFrames.cpp

@@ -1949,9 +1949,15 @@ SnapshotIterator::allocationValue(const RValueAllocation& alloc, ReadMethod rm)
         } pun;
         MOZ_ASSERT(alloc.fpuReg().isSingle());
         pun.d = fromRegister(alloc.fpuReg());
+#ifdef JS_CODEGEN_PPC_OSX
+        // The register is always written as a double, so we need to cast
+        // it down.
+        return Float32Value((float)pun.d);
+#else
         // The register contains the encoding of a float32. We just read
         // the bits without making any conversion.
         return Float32Value(pun.f);
+#endif
       }
 
       case RValueAllocation::ANY_FLOAT_STACK:

js/src/jit/shared/CodeGenerator-shared.cpp

@@ -1370,6 +1370,7 @@ CodeGeneratorShared::callVM(const VMFunction& fun, LInstruction* ins, const Regi
     // when returning from the call.  Failures are handled with exceptions based
     // on the return value of the C functions.  To guard the outcome of the
     // returned value, use another LIR instruction.
+    ensureOsiSpace();
     uint32_t callOffset = masm.callJit(wrapper);
     markSafepointAt(callOffset, ins);
 

js/src/vm/ErrorObject.cpp

@@ -174,34 +174,31 @@ js::ErrorObject::checkAndUnwrapThis(JSContext* cx, CallArgs& args, const char* f
     // the slots we need. This allows us to support the poor-man's subclassing
     // of error: Object.create(Error.prototype).
 
-    RootedObject target(cx, CheckedUnwrap(&thisValue.toObject()));
-    if (!target) {
+    RootedObject obj(cx, &args.thisv().toObject());
+    RootedObject curr(cx, obj);
+    RootedObject target(cx);
+    do {
+      target = CheckedUnwrap(curr);
+      if (!target) {
         JS_ReportError(cx, "Permission denied to access object");
         return false;
-    }
+      }
+      if (target->is<ErrorObject>()) {
+        error.set(&target->as<ErrorObject>());
+        return true;
+      }
 
-    RootedObject proto(cx);
-    while (!target->is<ErrorObject>()) {
-        if (!GetPrototype(cx, target, &proto))
-            return false;
+      if (!GetPrototype(cx, curr, &curr)) {
+        return false;
+      }
+    } while (curr);
 
-        if (!proto) {
-            // We walked the whole prototype chain and did not find an Error
-            // object.
-            JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
-                                 js_Error_str, fnName, thisValue.toObject().getClass()->name);
-            return false;
-        }
-
-        target = CheckedUnwrap(proto);
-        if (!target) {
-            JS_ReportError(cx, "Permission denied to access object");
-            return false;
-        }
-    }
-
-    error.set(&target->as<ErrorObject>());
-    return true;
+    // We walked the whole prototype chain and did not find an Error
+    // object.
+    JS_ReportErrorNumber(cx, GetErrorMessage, nullptr,
+                         JSMSG_INCOMPATIBLE_PROTO, js_Error_str,
+                         "(get stack)", obj->getClass()->name);
+    return false;
 }
 
 /* static */ bool

js/src/vm/Interpreter.cpp

@@ -3851,7 +3851,20 @@ END_CASE(JSOP_INITHOMEOBJECT)
 CASE(JSOP_SUPERBASE)
 {
     JSFunction& superEnvFunc = GetSuperEnvFunction(cx, REGS);
+#if(0)
+    // TenFourFox issue 488. This sometimes happens when we throw, so make
+    // it a warning.
     MOZ_ASSERT(superEnvFunc.allowSuperProperty());
+#else
+    if(!superEnvFunc.allowSuperProperty()) {
+#ifdef DEBUG
+        fprintf(stderr, "JSOP_SUPERBASE should only get things that allow SuperProperties\n");
+#endif
+        JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_CANT_CONVERT_TO,
+                                "null", "object");
+        goto error;
+    }
+#endif
     MOZ_ASSERT(superEnvFunc.nonLazyScript()->needsHomeObject());
     const Value& homeObjVal = superEnvFunc.getExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT);
 

js/xpconnect/src/XPCConvert.cpp

@@ -134,7 +134,7 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
         d.setNumber(*static_cast<const float*>(s));
         return true;
     case nsXPTType::T_DOUBLE:
-        d.setNumber(*static_cast<const double*>(s));
+        d.set(JS_NumberValue(*static_cast<const double*>(s)));
         return true;
     case nsXPTType::T_BOOL  :
         d.setBoolean(*static_cast<const bool*>(s));

js/xpconnect/src/XPCVariant.cpp

@@ -425,7 +425,7 @@ XPCVariant::VariantDataToJS(nsIVariant* variant,
             double d;
             if (NS_FAILED(variant->GetAsDouble(&d)))
                 return false;
-            pJSVal.setNumber(d);
+            pJSVal.set(JS_NumberValue(d));
             return true;
         }
         case nsIDataType::VTYPE_BOOL:

js/xpconnect/wrappers/XrayWrapper.h

@@ -254,6 +254,9 @@ public:
     {
         JSXrayTraits& self = JSXrayTraits::singleton;
         JS::RootedObject holder(cx, self.ensureHolder(cx, wrapper));
+        if (!holder) {
+          return false;
+        }
         if (self.getProtoKey(holder) == JSProto_Function)
             return baseInstance.call(cx, wrapper, args);
 
@@ -267,6 +270,9 @@ public:
     {
         JSXrayTraits& self = JSXrayTraits::singleton;
         JS::RootedObject holder(cx, self.ensureHolder(cx, wrapper));
+        if (!holder) {
+          return false;
+        }
         if (self.getProtoKey(holder) == JSProto_Function)
             return baseInstance.construct(cx, wrapper, args);
 
@@ -280,6 +286,9 @@ public:
                       JS::MutableHandleObject protop)
     {
         JS::RootedObject holder(cx, ensureHolder(cx, wrapper));
+        if (!holder) {
+          return false;
+        }
         JSProtoKey key = getProtoKey(holder);
         if (isPrototype(holder)) {
             JSProtoKey parentKey = js::ParentKeyForStandardClass(key);

layout/base/nsCSSFrameConstructor.cpp

@@ -3289,8 +3289,11 @@ nsCSSFrameConstructor::ConstructTextFrame(const FrameConstructionData* aData,
   // Add the newly constructed frame to the flow
   aFrameItems.AddChild(newFrame);
 
-  if (!aState.mCreatingExtraFrames)
+  if (!aState.mCreatingExtraFrames ||
+      (aContent->IsInNativeAnonymousSubtree() &&
+       !aContent->GetPrimaryFrame())) {
     aContent->SetPrimaryFrame(newFrame);
+  }
 }
 
 /* static */

layout/base/nsDocumentViewer.cpp

@@ -1540,8 +1540,6 @@ DetachContainerRecurse(nsIDocShell *aShell)
 NS_IMETHODIMP
 nsDocumentViewer::Destroy()
 {
-  NS_ASSERTION(mDocument, "No document in Destroy()!");
-
 #ifdef NS_PRINTING
   // Here is where we check to see if the document was still being prepared 
   // for printing when it was asked to be destroy from someone externally

layout/base/nsLayoutUtils.cpp

@@ -174,6 +174,9 @@ static ContentMap& GetContentMap() {
 // When the pref "layout.css.grid.enabled" changes, this function is invoked
 // to let us update kDisplayKTable, to selectively disable or restore the
 // entries for "grid" and "inline-grid" in that table.
+//
+// NB: as of TenFourFox issue 659, a whitelist entry per host is also required
+// to enable (but turning it off turns it off globally).
 static void
 GridEnabledPrefChangeCallback(const char* aPrefName, void* aClosure)
 {

layout/base/nsPresShell.cpp

@@ -6598,7 +6598,11 @@ PresShell::RecordMouseLocation(WidgetGUIEvent* aEvent)
 
 nsIFrame* GetNearestFrameContainingPresShell(nsIPresShell* aPresShell)
 {
-  nsView* view = aPresShell->GetViewManager()->GetRootView();
+  nsViewManager* vm = aPresShell->GetViewManager();
+  if (!vm) {
+    return nullptr;
+  }
+  nsView* view = vm->GetRootView();
   while (view && !view->GetFrame()) {
     view = view->GetParent();
   }

layout/style/nsCSSParser.cpp

@@ -1439,6 +1439,10 @@ protected:
   // Value to make sure our resolved variable results stay within sane limits.
   const uint32_t MAX_CSS_VAR_LENGTH = 10240;
 
+  // TenFourFox issue 659
+  // If this host is whitelisted, turn on CSS grid and inline grid.
+  bool mHostCSSGridOK : 1;
+
 public:
   // Used from nsCSSParser constructors and destructors
   CSSParserImpl* mNextFree;
@@ -1587,6 +1591,32 @@ CSSParserImpl::InitScanner(nsCSSScanner& aScanner,
   mSheetURI = aSheetURI;
   mSheetPrincipal = aSheetPrincipal;
   mHavePushBack = false;
+
+  // TenFourFox issue 659
+  mHostCSSGridOK = false;
+  if (MOZ_LIKELY(mBaseURI)) {
+    nsCString host;
+    bool isChrome;
+
+    // Never turn on grid for browser chrome.
+    nsresult rv = mBaseURI->SchemeIs("chrome", &isChrome);
+    if (NS_SUCCEEDED(rv) && !isChrome) {
+      // Get host and check pref.
+      rv = mBaseURI->GetHost(host);
+      if (NS_SUCCEEDED(rv) && !host.IsEmpty()) {
+        nsCString pref;
+
+        pref.AssignLiteral("layout.css.grid.host.");
+        pref.SetCapacity(pref.Length() + host.Length());
+        pref += host;
+        mHostCSSGridOK = Preferences::GetBool(pref.get(), false);
+#if DEBUG
+        if (mHostCSSGridOK)
+          fprintf(stderr, "CSS grid enabled for %s\n", pref.get());
+#endif
+      }
+    }
+  }
 }
 
 void
@@ -7586,6 +7616,14 @@ CSSParserImpl::ParseVariant(nsCSSValue& aValue,
       }
       if ((aVariantMask & VARIANT_KEYWORD) != 0) {
         int32_t value;
+
+        // TenFourFox issue 659
+        if (MOZ_UNLIKELY(!mHostCSSGridOK &&
+             aKeywordTable == nsCSSProps::kDisplayKTable &&
+             (keyword == eCSSKeyword_grid ||
+              keyword == eCSSKeyword_inline_grid))) {
+          // pretend the keyword wasn't found
+        } else
         if (nsCSSProps::FindKeyword(keyword, aKeywordTable, value)) {
           aValue.SetIntValue(value, eCSSUnit_Enumerated);
           return CSSParseResult::Ok;

layout/xul/nsMenuFrame.cpp

@@ -1267,7 +1267,9 @@ nsMenuFrame::PassMenuCommandEventToPopupManager()
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
   nsMenuParent* menuParent = GetMenuParent();
   if (pm && menuParent && mDelayedMenuCommandEvent) {
-    pm->ExecuteMenu(mContent, mDelayedMenuCommandEvent);
+    nsCOMPtr<nsIContent> content = mContent;
+    RefPtr<nsXULMenuCommandEvent> event = mDelayedMenuCommandEvent;
+    pm->ExecuteMenu(content, event);
   }
   mDelayedMenuCommandEvent = nullptr;
 }

media/libwebp/src/dec/vp8l_dec.c

@@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths(
   int symbol;
   int max_symbol;
   int prev_code_len = DEFAULT_CODE_LENGTH;
-  HuffmanCode table[1 << LENGTHS_TABLE_BITS];
+  HuffmanTables tables;
 
-  if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS,
-                             code_length_code_lengths,
-                             NUM_CODE_LENGTH_CODES)) {
+  if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) ||
+      !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS,
+                             code_length_code_lengths, NUM_CODE_LENGTH_CODES)) {
     goto End;
   }
 
@@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths(
     int code_len;
     if (max_symbol-- == 0) break;
     VP8LFillBitWindow(br);
-    p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
+    p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
     VP8LSetBitPos(br, br->bit_pos_ + p->bits);
     code_len = p->value;
     if (code_len < kCodeLengthLiterals) {
@@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths(
   ok = 1;
 
  End:
+  VP8LHuffmanTablesDeallocate(&tables);
   if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
   return ok;
 }
@@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths(
 // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman
 // tree.
 static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec,
-                           int* const code_lengths, HuffmanCode* const table) {
+                           int* const code_lengths,
+                           HuffmanTables* const table) {
   int ok = 0;
   int size = 0;
   VP8LBitReader* const br = &dec->br_;
@@ -362,12 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
   VP8LMetadata* const hdr = &dec->hdr_;
   uint32_t* huffman_image = NULL;
   HTreeGroup* htree_groups = NULL;
-  // When reading htrees, some might be unused, as the format allows it.
-  // We will still read them but put them in this htree_group_bogus.
-  HTreeGroup htree_group_bogus;
-  HuffmanCode* huffman_tables = NULL;
-  HuffmanCode* huffman_tables_bogus = NULL;
-  HuffmanCode* next = NULL;
+  HuffmanTables* huffman_tables = &hdr->huffman_tables_;
   int num_htree_groups = 1;
   int num_htree_groups_max = 1;
   int max_alphabet_size = 0;
@@ -376,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
   int* mapping = NULL;
   int ok = 0;
 
+  // Check the table has been 0 initialized (through InitMetadata).
+  assert(huffman_tables->root.start == NULL);
+  assert(huffman_tables->curr_segment == NULL);
+
   if (allow_recursion && VP8LReadBits(br, 1)) {
     // use meta Huffman codes.
     const int huffman_precision = VP8LReadBits(br, 3) + 2;
@@ -418,12 +419,6 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
         if (*mapped_group == -1) *mapped_group = num_htree_groups++;
         huffman_image[i] = *mapped_group;
       }
-      huffman_tables_bogus = (HuffmanCode*)WebPSafeMalloc(
-          table_size, sizeof(*huffman_tables_bogus));
-      if (huffman_tables_bogus == NULL) {
-        dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
-        goto Error;
-      }
     } else {
       num_htree_groups = num_htree_groups_max;
     }
@@ -444,72 +439,80 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
 
   code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size,
                                       sizeof(*code_lengths));
-  huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size,
-                                                sizeof(*huffman_tables));
   htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
 
-  if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) {
+  if (htree_groups == NULL || code_lengths == NULL ||
+      !VP8LHuffmanTablesAllocate(num_htree_groups * table_size,
+                                 huffman_tables)) {
     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
     goto Error;
   }
 
-  next = huffman_tables;
   for (i = 0; i < num_htree_groups_max; ++i) {
-    // If the index "i" is unused in the Huffman image, read the coefficients
-    // but store them to a bogus htree_group.
-    const int is_bogus = (mapping != NULL && mapping[i] == -1);
-    HTreeGroup* const htree_group =
-        is_bogus ? &htree_group_bogus :
-        &htree_groups[(mapping == NULL) ? i : mapping[i]];
-    HuffmanCode** const htrees = htree_group->htrees;
-    HuffmanCode* huffman_tables_i = is_bogus ? huffman_tables_bogus : next;
-    int size;
-    int total_size = 0;
-    int is_trivial_literal = 1;
-    int max_bits = 0;
-    for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
-      int alphabet_size = kAlphabetSize[j];
-      htrees[j] = huffman_tables_i;
-      if (j == 0 && color_cache_bits > 0) {
-        alphabet_size += 1 << color_cache_bits;
-      }
-      size =
-          ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables_i);
-      if (size == 0) {
-        goto Error;
-      }
-      if (is_trivial_literal && kLiteralMap[j] == 1) {
-        is_trivial_literal = (huffman_tables_i->bits == 0);
-      }
-      total_size += huffman_tables_i->bits;
-      huffman_tables_i += size;
-      if (j <= ALPHA) {
-        int local_max_bits = code_lengths[0];
-        int k;
-        for (k = 1; k < alphabet_size; ++k) {
-          if (code_lengths[k] > local_max_bits) {
-            local_max_bits = code_lengths[k];
-          }
+    // If the index "i" is unused in the Huffman image, just make sure the
+    // coefficients are valid but do not store them.
+    if (mapping != NULL && mapping[i] == -1) {
+      for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
+        int alphabet_size = kAlphabetSize[j];
+        if (j == 0 && color_cache_bits > 0) {
+          alphabet_size += (1 << color_cache_bits);
+        }
+        // Passing in NULL so that nothing gets filled.
+        if (!ReadHuffmanCode(alphabet_size, dec, code_lengths, NULL)) {
+          goto Error;
         }
-        max_bits += local_max_bits;
       }
-    }
-    if (!is_bogus) next = huffman_tables_i;
-    htree_group->is_trivial_literal = is_trivial_literal;
-    htree_group->is_trivial_code = 0;
-    if (is_trivial_literal) {
-      const int red = htrees[RED][0].value;
-      const int blue = htrees[BLUE][0].value;
-      const int alpha = htrees[ALPHA][0].value;
-      htree_group->literal_arb = ((uint32_t)alpha << 24) | (red << 16) | blue;
-      if (total_size == 0 && htrees[GREEN][0].value < NUM_LITERAL_CODES) {
-        htree_group->is_trivial_code = 1;
-        htree_group->literal_arb |= htrees[GREEN][0].value << 8;
+    } else {
+      HTreeGroup* const htree_group =
+          &htree_groups[(mapping == NULL) ? i : mapping[i]];
+      HuffmanCode** const htrees = htree_group->htrees;
+      int size;
+      int total_size = 0;
+      int is_trivial_literal = 1;
+      int max_bits = 0;
+      for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
+        int alphabet_size = kAlphabetSize[j];
+        if (j == 0 && color_cache_bits > 0) {
+          alphabet_size += (1 << color_cache_bits);
+        }
+        size =
+            ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables);
+        htrees[j] = huffman_tables->curr_segment->curr_table;
+        if (size == 0) {
+          goto Error;
+        }
+        if (is_trivial_literal && kLiteralMap[j] == 1) {
+          is_trivial_literal = (htrees[j]->bits == 0);
+        }
+        total_size += htrees[j]->bits;
+        huffman_tables->curr_segment->curr_table += size;
+        if (j <= ALPHA) {
+          int local_max_bits = code_lengths[0];
+          int k;
+          for (k = 1; k < alphabet_size; ++k) {
+            if (code_lengths[k] > local_max_bits) {
+              local_max_bits = code_lengths[k];
+            }
+          }
+          max_bits += local_max_bits;
+        }
       }
+      htree_group->is_trivial_literal = is_trivial_literal;
+      htree_group->is_trivial_code = 0;
+      if (is_trivial_literal) {
+        const int red = htrees[RED][0].value;
+        const int blue = htrees[BLUE][0].value;
+        const int alpha = htrees[ALPHA][0].value;
+        htree_group->literal_arb = ((uint32_t)alpha << 24) | (red << 16) | blue;
+        if (total_size == 0 && htrees[GREEN][0].value < NUM_LITERAL_CODES) {
+          htree_group->is_trivial_code = 1;
+          htree_group->literal_arb |= htrees[GREEN][0].value << 8;
+        }
+      }
+      htree_group->use_packed_table =
+          !htree_group->is_trivial_code && (max_bits < HUFFMAN_PACKED_BITS);
+      if (htree_group->use_packed_table) BuildPackedTable(htree_group);
     }
-    htree_group->use_packed_table =
-        !htree_group->is_trivial_code && (max_bits < HUFFMAN_PACKED_BITS);
-    if (htree_group->use_packed_table) BuildPackedTable(htree_group);
   }
   ok = 1;
 
@@ -517,15 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
   hdr->huffman_image_ = huffman_image;
   hdr->num_htree_groups_ = num_htree_groups;
   hdr->htree_groups_ = htree_groups;
-  hdr->huffman_tables_ = huffman_tables;
 
  Error:
   WebPSafeFree(code_lengths);
-  WebPSafeFree(huffman_tables_bogus);
   WebPSafeFree(mapping);
   if (!ok) {
     WebPSafeFree(huffman_image);
-    WebPSafeFree(huffman_tables);
+    VP8LHuffmanTablesDeallocate(huffman_tables);
     VP8LHtreeGroupsFree(htree_groups);
   }
   return ok;
@@ -1236,9 +1237,20 @@ static int DecodeImageData(VP8LDecoder* const dec, uint32_t* const data,
   }
 
   br->eos_ = VP8LIsEndOfStream(br);
-  if (dec->incremental_ && br->eos_ && src < src_end) {
+  // In incremental decoding:
+  // br->eos_ && src < src_last: if 'br' reached the end of the buffer and
+  // 'src_last' has not been reached yet, there is not enough data. 'dec' has to
+  // be reset until there is more data.
+  // !br->eos_ && src < src_last: this cannot happen as either the buffer is
+  // fully read, either enough has been read to reach 'src_last'.
+  // src >= src_last: 'src_last' is reached, all is fine. 'src' can actually go
+  // beyond 'src_last' in case the image is cropped and an LZ77 goes further.
+  // The buffer might have been enough or there is some left. 'br->eos_' does
+  // not matter.
+  assert(!dec->incremental_ || (br->eos_ && src < src_last) || src >= src_last);
+  if (dec->incremental_ && br->eos_ && src < src_last) {
     RestoreState(dec);
-  } else if (!br->eos_) {
+  } else if ((dec->incremental_ && src >= src_last) || !br->eos_) {
     // Process the remaining rows corresponding to last row-block.
     if (process_func != NULL) {
       process_func(dec, row > last_row ? last_row : row);
@@ -1357,7 +1369,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) {
   assert(hdr != NULL);
 
   WebPSafeFree(hdr->huffman_image_);
-  WebPSafeFree(hdr->huffman_tables_);
+  VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_);
   VP8LHtreeGroupsFree(hdr->htree_groups_);
   VP8LColorCacheClear(&hdr->color_cache_);
   VP8LColorCacheClear(&hdr->saved_color_cache_);
@@ -1673,7 +1685,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) {
   // Sanity checks.
   if (dec == NULL) return 0;
 
-  assert(dec->hdr_.huffman_tables_ != NULL);
+  assert(dec->hdr_.huffman_tables_.root.start != NULL);
   assert(dec->hdr_.htree_groups_ != NULL);
   assert(dec->hdr_.num_htree_groups_ > 0);
 

media/libwebp/src/dec/vp8li_dec.h

@@ -51,7 +51,7 @@ typedef struct {
   uint32_t       *huffman_image_;
   int             num_htree_groups_;
   HTreeGroup     *htree_groups_;
-  HuffmanCode    *huffman_tables_;
+  HuffmanTables   huffman_tables_;
 } VP8LMetadata;
 
 typedef struct VP8LDecoder VP8LDecoder;

media/libwebp/src/utils/huffman_utils.c

@@ -91,7 +91,8 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
 
   assert(code_lengths_size != 0);
   assert(code_lengths != NULL);
-  assert(root_table != NULL);
+  assert((root_table != NULL && sorted != NULL) ||
+         (root_table == NULL && sorted == NULL));
   assert(root_bits > 0);
 
   // Build histogram of code lengths.
@@ -120,16 +121,22 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
   for (symbol = 0; symbol < code_lengths_size; ++symbol) {
     const int symbol_code_length = code_lengths[symbol];
     if (code_lengths[symbol] > 0) {
-      sorted[offset[symbol_code_length]++] = symbol;
+      if (sorted != NULL) {
+        sorted[offset[symbol_code_length]++] = symbol;
+      } else {
+        offset[symbol_code_length]++;
+      }
     }
   }
 
   // Special case code with only one value.
   if (offset[MAX_ALLOWED_CODE_LENGTH] == 1) {
-    HuffmanCode code;
-    code.bits = 0;
-    code.value = (uint16_t)sorted[0];
-    ReplicateValue(table, 1, total_size, code);
+    if (sorted != NULL) {
+      HuffmanCode code;
+      code.bits = 0;
+      code.value = (uint16_t)sorted[0];
+      ReplicateValue(table, 1, total_size, code);
+    }
     return total_size;
   }
 
@@ -151,6 +158,7 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
       if (num_open < 0) {
         return 0;
       }
+      if (root_table == NULL) continue;
       for (; count[len] > 0; --count[len]) {
         HuffmanCode code;
         code.bits = (uint8_t)len;
@@ -172,17 +180,21 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
       for (; count[len] > 0; --count[len]) {
         HuffmanCode code;
         if ((key & mask) != low) {
-          table += table_size;
+          if (root_table != NULL) table += table_size;
           table_bits = NextTableBitSize(count, len, root_bits);
           table_size = 1 << table_bits;
           total_size += table_size;
           low = key & mask;
-          root_table[low].bits = (uint8_t)(table_bits + root_bits);
-          root_table[low].value = (uint16_t)((table - root_table) - low);
+          if (root_table != NULL) {
+            root_table[low].bits = (uint8_t)(table_bits + root_bits);
+            root_table[low].value = (uint16_t)((table - root_table) - low);
+          }
+        }
+        if (root_table != NULL) {
+          code.bits = (uint8_t)(len - root_bits);
+          code.value = (uint16_t)sorted[symbol++];
+          ReplicateValue(&table[key >> root_bits], step, table_size, code);
         }
-        code.bits = (uint8_t)(len - root_bits);
-        code.value = (uint16_t)sorted[symbol++];
-        ReplicateValue(&table[key >> root_bits], step, table_size, code);
         key = GetNextKey(key, len);
       }
     }
@@ -202,22 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
   ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES)
 // Cut-off value for switching between heap and stack allocation.
 #define SORTED_SIZE_CUTOFF 512
-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
                           const int code_lengths[], int code_lengths_size) {
-  int total_size;
+  const int total_size =
+      BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL);
   assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE);
+  if (total_size == 0 || root_table == NULL) return total_size;
+
+  if (root_table->curr_segment->curr_table + total_size >=
+      root_table->curr_segment->start + root_table->curr_segment->size) {
+    // If 'root_table' does not have enough memory, allocate a new segment.
+    // The available part of root_table->curr_segment is left unused because we
+    // need a contiguous buffer.
+    const int segment_size = root_table->curr_segment->size;
+    struct HuffmanTablesSegment* next =
+        (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next));
+    if (next == NULL) return 0;
+    // Fill the new segment.
+    // We need at least 'total_size' but if that value is small, it is better to
+    // allocate a big chunk to prevent more allocations later. 'segment_size' is
+    // therefore chosen (any other arbitrary value could be chosen).
+    next->size = total_size > segment_size ? total_size : segment_size;
+    next->start =
+        (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start));
+    if (next->start == NULL) {
+      WebPSafeFree(next);
+      return 0;
+    }
+    next->curr_table = next->start;
+    next->next = NULL;
+    // Point to the new segment.
+    root_table->curr_segment->next = next;
+    root_table->curr_segment = next;
+  }
   if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
     // use local stack-allocated array.
     uint16_t sorted[SORTED_SIZE_CUTOFF];
-    total_size = BuildHuffmanTable(root_table, root_bits,
-                                   code_lengths, code_lengths_size, sorted);
-  } else {   // rare case. Use heap allocation.
+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
+                      code_lengths, code_lengths_size, sorted);
+  } else {  // rare case. Use heap allocation.
     uint16_t* const sorted =
         (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted));
     if (sorted == NULL) return 0;
-    total_size = BuildHuffmanTable(root_table, root_bits,
-                                   code_lengths, code_lengths_size, sorted);
+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
+                      code_lengths, code_lengths_size, sorted);
     WebPSafeFree(sorted);
   }
   return total_size;
 }
+
+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) {
+  // Have 'segment' point to the first segment for now, 'root'.
+  HuffmanTablesSegment* const root = &huffman_tables->root;
+  huffman_tables->curr_segment = root;
+  root->next = NULL;
+  // Allocate root.
+  root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start));
+  if (root->start == NULL) return 0;
+  root->curr_table = root->start;
+  root->size = size;
+  return 1;
+}
+
+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) {
+  HuffmanTablesSegment *current, *next;
+  if (huffman_tables == NULL) return;
+  // Free the root node.
+  current = &huffman_tables->root;
+  next = current->next;
+  WebPSafeFree(current->start);
+  current->start = NULL;
+  current->next = NULL;
+  current = next;
+  // Free the following nodes.
+  while (current != NULL) {
+    next = current->next;
+    WebPSafeFree(current->start);
+    WebPSafeFree(current);
+    current = next;
+  }
+}

media/libwebp/src/utils/huffman_utils.h

@@ -43,6 +43,29 @@ typedef struct {
                     // or non-literal symbol otherwise
 } HuffmanCode32;
 
+// Contiguous memory segment of HuffmanCodes.
+typedef struct HuffmanTablesSegment {
+  HuffmanCode* start;
+  // Pointer to where we are writing into the segment. Starts at 'start' and
+  // cannot go beyond 'start' + 'size'.
+  HuffmanCode* curr_table;
+  // Pointer to the next segment in the chain.
+  struct HuffmanTablesSegment* next;
+  int size;
+} HuffmanTablesSegment;
+
+// Chained memory segments of HuffmanCodes.
+typedef struct HuffmanTables {
+  HuffmanTablesSegment root;
+  // Currently processed segment. At first, this is 'root'.
+  HuffmanTablesSegment* curr_segment;
+} HuffmanTables;
+
+// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on
+// memory allocation error, 1 otherwise.
+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables);
+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables);
+
 #define HUFFMAN_PACKED_BITS 6
 #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS)
 
@@ -78,7 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups);
 // the huffman table.
 // Returns built table size or 0 in case of error (invalid tree or
 // memory error).
-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
                           const int code_lengths[], int code_lengths_size);
 
 #ifdef __cplusplus

media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp

@@ -63,6 +63,7 @@
 #include "mozilla/Telemetry.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/PublicSSL.h"
+#include "nsNetUtil.h"  // NS_CheckPortSafety
 #include "nsXULAppAPI.h"
 #include "nsContentUtils.h"
 #include "nsDOMJSUtils.h"
@@ -422,8 +423,9 @@ PeerConnectionImpl::~PeerConnectionImpl()
     destroy_timecard(mTimeCard);
     mTimeCard = nullptr;
   }
-  // This aborts if not on main thread (in Debug builds)
-  PC_AUTO_ENTER_API_CALL_NO_CHECK();
+
+  MOZ_ASSERT(NS_IsMainThread());
+
   if (PeerConnectionCtx::isActive()) {
     PeerConnectionCtx::GetInstance()->mPeerConnections.erase(mHandle);
   } else {
@@ -547,6 +549,13 @@ PeerConnectionConfiguration::Init(const RTCConfiguration& aSrc)
   return NS_OK;
 }
 
+// list of known acceptable ports for webrtc
+int16_t gGoodWebrtcPortList[] = {
+    3478,  // stun or turn
+    5349,  // stuns or turns
+    0,     // Sentinel value: This MUST be zero
+};
+
 nsresult
 PeerConnectionConfiguration::AddIceServer(const RTCIceServer &aServer)
 {
@@ -620,6 +629,21 @@ PeerConnectionConfiguration::AddIceServer(const RTCIceServer &aServer)
     if (port == -1)
       port = (isStuns || isTurns)? 5349 : 3478;
 
+    // First check the known good ports for webrtc
+    bool goodPort = false;
+    for (int i = 0; !goodPort && gGoodWebrtcPortList[i]; i++) {
+      if (port == gGoodWebrtcPortList[i]) {
+        goodPort = true;
+      }
+    }
+
+    // if not in the list of known good ports for webrtc, check
+    // the generic block list using NS_CheckPortSafety.
+    if (!goodPort) {
+      rv = NS_CheckPortSafety(port, nullptr);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+
     if (isTurn || isTurns) {
       NS_ConvertUTF16toUTF8 credential(aServer.mCredential);
       NS_ConvertUTF16toUTF8 username(aServer.mUsername);
@@ -2582,7 +2606,7 @@ PeerConnectionImpl::CloseInt()
 void
 PeerConnectionImpl::ShutdownMedia()
 {
-  PC_AUTO_ENTER_API_CALL_NO_CHECK();
+  MOZ_ASSERT(NS_IsMainThread());
 
   if (!mMedia)
     return;

modules/libjar/moz.build

@@ -48,5 +48,9 @@ include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'
 
+LOCAL_INCLUDES += [
+    '/netwerk/base',
+]
+
 if CONFIG['GNU_CXX']:
     CXXFLAGS += ['-Wshadow']

modules/libjar/nsJARChannel.cpp

@@ -28,6 +28,7 @@
 #include "nsINetworkInterceptController.h"
 #include "InterceptedJARChannel.h"
 #include "nsInputStreamPump.h"
+#include "nsStandardURL.h"
 
 using namespace mozilla;
 using namespace mozilla::net;
@@ -83,6 +84,24 @@ public:
                 fullJarURI->GetAsciiSpec(mJarDirSpec);
             NS_ASSERTION(NS_SUCCEEDED(rv), "this shouldn't fail");
         }
+        /* implement bug 1771774 without NS_MutateURI: use asciispec above */
+        if (ENTRY_IS_DIRECTORY(mJarEntry) && fullJarURI) {
+            RefPtr<nsStandardURL> cleanuri = new nsStandardURL();
+
+            if (NS_SUCCEEDED(cleanuri->Init(
+                             nsIStandardURL::URLTYPE_NO_AUTHORITY, -1,
+                             mJarDirSpec, nullptr, nullptr))) {
+                cleanuri->SetQuery(NS_LITERAL_CSTRING(""));
+                cleanuri->SetRef(NS_LITERAL_CSTRING(""));
+#ifdef DEBUG
+                nsresult rv =
+#endif
+                    cleanuri->GetAsciiSpec(mJarDirSpec);
+                NS_ASSERTION(NS_SUCCEEDED(rv), "this shouldn't fail either");
+            } else {
+                MOZ_CRASH("failed to clean jar URI");
+            }
+        }
     }
 
     int64_t GetContentLength()
@@ -695,48 +714,50 @@ nsJARChannel::GetSecurityInfo(nsISupports **aSecurityInfo)
     return NS_OK;
 }
 
+nsresult
+nsJARChannel::SetContentTypeGuess() {
+    //
+    // generate content type and set it
+    //
+    const char *ext = nullptr, *fileName = mJarEntry.get();
+    int32_t len = mJarEntry.Length();
+
+    // check if we're displaying a directory
+    // mJarEntry will be empty if we're trying to display
+    // the topmost directory in a zip, e.g. jar:foo.zip!/
+    if (ENTRY_IS_DIRECTORY(mJarEntry)) {
+        mContentType.AssignLiteral(APPLICATION_HTTP_INDEX_FORMAT);
+    } else {
+        // not a directory, take a guess by its extension
+        for (int32_t i = len-1; i >= 0; i--) {
+            if (fileName[i] == '.') {
+                ext = &fileName[i + 1];
+                break;
+            }
+        }
+        if (ext) {
+            nsIMIMEService *mimeServ = gJarHandler->MimeService();
+            if (mimeServ)
+                mimeServ->GetTypeFromExtension(nsDependentCString(ext), mContentType);
+        }
+        if (mContentType.IsEmpty())
+            mContentType.AssignLiteral(UNKNOWN_CONTENT_TYPE);
+    }
+
+    return NS_OK;
+}
+
 NS_IMETHODIMP
-nsJARChannel::GetContentType(nsACString &result)
+nsJARChannel::GetContentType(nsACString &aResult)
 {
     // If the Jar file has not been open yet,
     // We return application/x-unknown-content-type
-    if (!mOpened) {
-      result.Assign(UNKNOWN_CONTENT_TYPE);
+    if (!mOpened || mContentType.IsEmpty()) {
+      aResult.Assign(UNKNOWN_CONTENT_TYPE);
       return NS_OK;
     }
 
-    if (mContentType.IsEmpty()) {
-
-        //
-        // generate content type and set it
-        //
-        const char *ext = nullptr, *fileName = mJarEntry.get();
-        int32_t len = mJarEntry.Length();
-
-        // check if we're displaying a directory
-        // mJarEntry will be empty if we're trying to display
-        // the topmost directory in a zip, e.g. jar:foo.zip!/
-        if (ENTRY_IS_DIRECTORY(mJarEntry)) {
-            mContentType.AssignLiteral(APPLICATION_HTTP_INDEX_FORMAT);
-        }
-        else {
-            // not a directory, take a guess by its extension
-            for (int32_t i = len-1; i >= 0; i--) {
-                if (fileName[i] == '.') {
-                    ext = &fileName[i + 1];
-                    break;
-                }
-            }
-            if (ext) {
-                nsIMIMEService *mimeServ = gJarHandler->MimeService();
-                if (mimeServ)
-                    mimeServ->GetTypeFromExtension(nsDependentCString(ext), mContentType);
-            }
-            if (mContentType.IsEmpty())
-                mContentType.AssignLiteral(UNKNOWN_CONTENT_TYPE);
-        }
-    }
-    result = mContentType;
+    aResult = mContentType;
     return NS_OK;
 }
 
@@ -847,7 +868,7 @@ nsJARChannel::Open(nsIInputStream **stream)
         return rv;
 
     input.forget(stream);
-    mOpened = true;
+    SetOpened();
     // local files are always considered safe
     mIsUnsafe = false;
     return NS_OK;
@@ -934,6 +955,14 @@ nsJARChannel::OverrideWithSynthesizedResponse(nsIInputStream* aSynthesizedInput,
     NS_ENSURE_SUCCESS_VOID(rv);
 }
 
+void
+nsJARChannel::SetOpened() {
+    MOZ_ASSERT(!mOpened, "Opening channel twice?");
+    mOpened = true;
+    // Compute the content type now.
+    NS_ASSERTION(NS_SUCCEEDED(SetContentTypeGuess()), "content type guess failure");
+}
+
 NS_IMETHODIMP
 nsJARChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *ctx)
 {
@@ -1068,7 +1097,7 @@ nsJARChannel::FinishAsyncOpen()
     if (mLoadGroup)
         mLoadGroup->AddRequest(this, nullptr);
 
-    mOpened = true;
+    SetOpened();
 }
 
 //-----------------------------------------------------------------------------

modules/libjar/nsJARChannel.h

@@ -82,6 +82,9 @@ private:
 
     bool BypassServiceWorker() const;
 
+    nsresult SetContentTypeGuess();
+    void SetOpened();
+
     // Returns true if this channel should intercept the network request and
     // prepare for a possible synthesized response instead.
     bool ShouldIntercept();

modules/libjar/nsZipArchive.cpp

@@ -826,6 +826,11 @@ MOZ_WIN_MEM_TRY_BEGIN
   uint32_t offset = aItem->LocalOffset();
   if (len < ZIPLOCAL_SIZE || offset > len - ZIPLOCAL_SIZE)
     return 0;
+  // Check there's enough space for the signature
+  if (offset > mFd->mLen) {
+    NS_WARNING("Corrupt local offset in JAR file");
+    return 0;
+  }
 
   // -- check signature before using the structure, in case the zip file is corrupt
   ZipLocal* Local = (ZipLocal*)(data + offset);
@@ -838,6 +843,11 @@ MOZ_WIN_MEM_TRY_BEGIN
   offset += ZIPLOCAL_SIZE +
             xtoint(Local->filename_len) +
             xtoint(Local->extrafield_len);
+  // Check data points inside the file.
+  if (offset > mFd->mLen) {
+    NS_WARNING("Corrupt local offset in JAR file");
+    return 0;
+  }
 
   return offset;
 MOZ_WIN_MEM_TRY_CATCH(return 0)

modules/libpref/init/all.js

@@ -1219,7 +1219,15 @@ pref("network.protocol-handler.external.hcp", false);
 pref("network.protocol-handler.external.vbscript", false);
 pref("network.protocol-handler.external.javascript", false);
 pref("network.protocol-handler.external.data", false);
+pref("network.protocol-handler.external.ie.http", false);
+pref("network.protocol-handler.external.iehistory", false);
+pref("network.protocol-handler.external.ierss", false);
+pref("network.protocol-handler.external.mk", false);
 pref("network.protocol-handler.external.ms-help", false);
+pref("network.protocol-handler.external.ms-msdt", false);
+pref("network.protocol-handler.external.res", false);
+pref("network.protocol-handler.external.search", false);
+pref("network.protocol-handler.external.search-ms", false);
 pref("network.protocol-handler.external.shell", false);
 pref("network.protocol-handler.external.vnd.ms.radio", false);
 #ifdef XP_MACOSX
@@ -1232,9 +1240,11 @@ pref("network.protocol-handler.external.moz-icon", false);
 
 // Don't allow  external protocol handlers for common typos
 pref("network.protocol-handler.external.ttp", false);  // http
+pref("network.protocol-handler.external.htp", false);  // http
 pref("network.protocol-handler.external.ttps", false); // https
 pref("network.protocol-handler.external.tps", false);  // https
 pref("network.protocol-handler.external.ps", false);   // https
+pref("network.protocol-handler.external.htps", false); // https
 pref("network.protocol-handler.external.ile", false);  // file
 pref("network.protocol-handler.external.le", false);   // file
 
@@ -1429,7 +1439,7 @@ pref("network.http.spdy.default-concurrent", 100);
 // alt-svc allows separation of transport routing from
 // the origin host without using a proxy.
 pref("network.http.altsvc.enabled", true);
-pref("network.http.altsvc.oe", true);
+pref("network.http.altsvc.oe", false); // bug 1730935
 
 pref("network.http.diagnostics", false);
 
@@ -2385,11 +2395,10 @@ pref("layout.css.variables.enabled", true);
 pref("layout.css.overflow-clip-box.enabled", false);
 
 // Is support for CSS grid enabled?
-#ifdef RELEASE_BUILD
-pref("layout.css.grid.enabled", false);
-#else
+// TenFourFox issue 659 makes this into a per-host whitelist.
 pref("layout.css.grid.enabled", true);
-#endif
+// Whitelist by default:
+pref("layout.css.grid.host.developer.mozilla.org", true);
 
 // Is support for CSS "grid-template-{columns,rows}: subgrid X" enabled?
 pref("layout.css.grid-template-subgrid-value.enabled", false);
@@ -4098,6 +4107,7 @@ pref("signon.rememberSignons.visibilityToggle", false);
 #endif
 pref("signon.autofillForms",                true);
 pref("signon.autologin.proxy",              false);
+pref("signon.privateBrowsingCapture.enabled", false);
 pref("signon.storeWhenAutocompleteOff",     true);
 pref("signon.ui.experimental",              false);
 pref("signon.debug",                        false);

modules/zlib/src/ChangeLog.104fx

@@ -0,0 +1,2 @@
+updated to 1.2.12 + VMX changes + moz changes 2022-08-28
+

modules/zlib/src/adler32.c

@@ -1,5 +1,5 @@
 /* adler32.c -- compute the Adler-32 checksum of a data stream
- * Copyright (C) 1995-2011 Mark Adler
+ * Copyright (C) 1995-2011, 2016 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -7,11 +7,9 @@
 
 #include "zutil.h"
 
-#define local static
-
 local uLong adler32_combine_ OF((uLong adler1, uLong adler2, z_off64_t len2));
 
-#define BASE 65521      /* largest prime smaller than 65536 */
+#define BASE 65521U     /* largest prime smaller than 65536 */
 #define NMAX 5552
 /* NMAX is the largest n such that 255n(n+1)/2 + (n+1)(BASE-1) <= 2^32-1 */
 
@@ -62,10 +60,10 @@ local uLong adler32_combine_ OF((uLong adler1, uLong adler2, z_off64_t len2));
 #endif
 
 /* ========================================================================= */
-uLong ZEXPORT adler32(adler, buf, len)
+uLong ZEXPORT adler32_z(adler, buf, len)
     uLong adler;
     const Bytef *buf;
-    uInt len;
+    z_size_t len;
 {
     unsigned long sum2;
     unsigned n;
@@ -132,6 +130,15 @@ uLong ZEXPORT adler32(adler, buf, len)
     return adler | (sum2 << 16);
 }
 
+/* ========================================================================= */
+uLong ZEXPORT adler32(adler, buf, len)
+    uLong adler;
+    const Bytef *buf;
+    uInt len;
+{
+    return adler32_z(adler, buf, len);
+}
+
 /* ========================================================================= */
 local uLong adler32_combine_(adler1, adler2, len2)
     uLong adler1;
@@ -156,7 +163,7 @@ local uLong adler32_combine_(adler1, adler2, len2)
     sum2 += ((adler1 >> 16) & 0xffff) + ((adler2 >> 16) & 0xffff) + BASE - rem;
     if (sum1 >= BASE) sum1 -= BASE;
     if (sum1 >= BASE) sum1 -= BASE;
-    if (sum2 >= (BASE << 1)) sum2 -= (BASE << 1);
+    if (sum2 >= ((unsigned long)BASE << 1)) sum2 -= ((unsigned long)BASE << 1);
     if (sum2 >= BASE) sum2 -= BASE;
     return sum1 | (sum2 << 16);
 }

modules/zlib/src/compress.c

@@ -1,5 +1,5 @@
 /* compress.c -- compress a memory buffer
- * Copyright (C) 1995-2005 Jean-loup Gailly.
+ * Copyright (C) 1995-2005, 2014, 2016 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -28,16 +28,11 @@ int ZEXPORT compress2 (dest, destLen, source, sourceLen, level)
 {
     z_stream stream;
     int err;
+    const uInt max = (uInt)-1;
+    uLong left;
 
-    stream.next_in = (z_const Bytef *)source;
-    stream.avail_in = (uInt)sourceLen;
-#ifdef MAXSEG_64K
-    /* Check for source > 64K on 16-bit machine: */
-    if ((uLong)stream.avail_in != sourceLen) return Z_BUF_ERROR;
-#endif
-    stream.next_out = dest;
-    stream.avail_out = (uInt)*destLen;
-    if ((uLong)stream.avail_out != *destLen) return Z_BUF_ERROR;
+    left = *destLen;
+    *destLen = 0;
 
     stream.zalloc = (alloc_func)0;
     stream.zfree = (free_func)0;
@@ -46,15 +41,26 @@ int ZEXPORT compress2 (dest, destLen, source, sourceLen, level)
     err = deflateInit(&stream, level);
     if (err != Z_OK) return err;
 
-    err = deflate(&stream, Z_FINISH);
-    if (err != Z_STREAM_END) {
-        deflateEnd(&stream);
-        return err == Z_OK ? Z_BUF_ERROR : err;
-    }
-    *destLen = stream.total_out;
+    stream.next_out = dest;
+    stream.avail_out = 0;
+    stream.next_in = (z_const Bytef *)source;
+    stream.avail_in = 0;
 
-    err = deflateEnd(&stream);
-    return err;
+    do {
+        if (stream.avail_out == 0) {
+            stream.avail_out = left > (uLong)max ? max : (uInt)left;
+            left -= stream.avail_out;
+        }
+        if (stream.avail_in == 0) {
+            stream.avail_in = sourceLen > (uLong)max ? max : (uInt)sourceLen;
+            sourceLen -= stream.avail_in;
+        }
+        err = deflate(&stream, sourceLen ? Z_NO_FLUSH : Z_FINISH);
+    } while (err == Z_OK);
+
+    *destLen = stream.total_out;
+    deflateEnd(&stream);
+    return err == Z_STREAM_END ? Z_OK : err;
 }
 
 /* ===========================================================================

modules/zlib/src/deflate.h

@@ -1,5 +1,5 @@
 /* deflate.h -- internal compression state
- * Copyright (C) 1995-2012 Jean-loup Gailly
+ * Copyright (C) 1995-2018 Jean-loup Gailly
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -51,13 +51,16 @@
 #define Buf_size 16
 /* size of bit buffer in bi_buf */
 
-#define INIT_STATE    42
-#define EXTRA_STATE   69
-#define NAME_STATE    73
-#define COMMENT_STATE 91
-#define HCRC_STATE   103
-#define BUSY_STATE   113
-#define FINISH_STATE 666
+#define INIT_STATE    42    /* zlib header -> BUSY_STATE */
+#ifdef GZIP
+#  define GZIP_STATE  57    /* gzip header -> BUSY_STATE | EXTRA_STATE */
+#endif
+#define EXTRA_STATE   69    /* gzip extra block -> NAME_STATE */
+#define NAME_STATE    73    /* gzip file name -> COMMENT_STATE */
+#define COMMENT_STATE 91    /* gzip comment -> HCRC_STATE */
+#define HCRC_STATE   103    /* gzip header CRC -> BUSY_STATE */
+#define BUSY_STATE   113    /* deflate -> FINISH_STATE */
+#define FINISH_STATE 666    /* stream complete */
 /* Stream status */
 
 
@@ -83,7 +86,7 @@ typedef struct static_tree_desc_s  static_tree_desc;
 typedef struct tree_desc_s {
     ct_data *dyn_tree;           /* the dynamic tree */
     int     max_code;            /* largest code with non zero frequency */
-    static_tree_desc *stat_desc; /* the corresponding static tree */
+    const static_tree_desc *stat_desc;  /* the corresponding static tree */
 } FAR tree_desc;
 
 typedef ush Pos;
@@ -100,10 +103,10 @@ typedef struct internal_state {
     Bytef *pending_buf;  /* output still pending */
     ulg   pending_buf_size; /* size of pending_buf */
     Bytef *pending_out;  /* next pending byte to output to the stream */
-    uInt   pending;      /* nb of bytes in the pending buffer */
+    ulg   pending;       /* nb of bytes in the pending buffer */
     int   wrap;          /* bit 0 true for zlib, bit 1 true for gzip */
     gz_headerp  gzhead;  /* gzip header information to write */
-    uInt   gzindex;      /* where in extra, name, or comment */
+    ulg   gzindex;       /* where in extra, name, or comment */
     Byte  method;        /* can only be DEFLATED */
     int   last_flush;    /* value of flush param for previous deflate call */
 
@@ -214,7 +217,7 @@ typedef struct internal_state {
     /* Depth of each subtree used as tie breaker for trees of equal frequency
      */
 
-    uchf *l_buf;          /* buffer for literals or lengths */
+    uchf *sym_buf;        /* buffer for distances and literals/lengths */
 
     uInt  lit_bufsize;
     /* Size of match buffer for literals/lengths.  There are 4 reasons for
@@ -236,20 +239,15 @@ typedef struct internal_state {
      *   - I can't count above 4
      */
 
-    uInt last_lit;      /* running index in l_buf */
-
-    ushf *d_buf;
-    /* Buffer for distances. To simplify the code, d_buf and l_buf have
-     * the same number of elements. To use different lengths, an extra flag
-     * array would be necessary.
-     */
+    uInt sym_next;      /* running index in sym_buf */
+    uInt sym_end;       /* symbol table full when sym_next reaches this */
 
     ulg opt_len;        /* bit length of current block with optimal trees */
     ulg static_len;     /* bit length of current block with static trees */
     uInt matches;       /* number of string matches in current block */
     uInt insert;        /* bytes at end of window left to insert */
 
-#ifdef DEBUG
+#ifdef ZLIB_DEBUG
     ulg compressed_len; /* total bit length of compressed file mod 2^32 */
     ulg bits_sent;      /* bit length of compressed data sent mod 2^32 */
 #endif
@@ -275,7 +273,7 @@ typedef struct internal_state {
 /* Output a byte on the stream.
  * IN assertion: there is enough room in pending_buf.
  */
-#define put_byte(s, c) {s->pending_buf[s->pending++] = (c);}
+#define put_byte(s, c) {s->pending_buf[s->pending++] = (Bytef)(c);}
 
 
 #define MIN_LOOKAHEAD (MAX_MATCH+MIN_MATCH+1)
@@ -309,7 +307,7 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
  * used.
  */
 
-#ifndef DEBUG
+#ifndef ZLIB_DEBUG
 /* Inline versions of _tr_tally for speed: */
 
 #if defined(GEN_TREES_H) || !defined(STDC)
@@ -322,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
 
 # define _tr_tally_lit(s, c, flush) \
   { uch cc = (c); \
-    s->d_buf[s->last_lit] = 0; \
-    s->l_buf[s->last_lit++] = cc; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = cc; \
     s->dyn_ltree[cc].Freq++; \
-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
    }
 # define _tr_tally_dist(s, distance, length, flush) \
-  { uch len = (length); \
-    ush dist = (distance); \
-    s->d_buf[s->last_lit] = dist; \
-    s->l_buf[s->last_lit++] = len; \
+  { uch len = (uch)(length); \
+    ush dist = (ush)(distance); \
+    s->sym_buf[s->sym_next++] = dist; \
+    s->sym_buf[s->sym_next++] = dist >> 8; \
+    s->sym_buf[s->sym_next++] = len; \
     dist--; \
     s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
     s->dyn_dtree[d_code(dist)].Freq++; \
-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
   }
 #else
 # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)

modules/zlib/src/gzguts.h

@@ -1,5 +1,5 @@
 /* gzguts.h -- zlib internal header definitions for gz* operations
- * Copyright (C) 2004, 2005, 2010, 2011, 2012, 2013 Mark Adler
+ * Copyright (C) 2004-2019 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -25,6 +25,10 @@
 #  include <stdlib.h>
 #  include <limits.h>
 #endif
+
+#ifndef _POSIX_SOURCE
+#  define _POSIX_SOURCE
+#endif
 #include <fcntl.h>
 
 #ifdef _WIN32
@@ -35,6 +39,10 @@
 #  include <io.h>
 #endif
 
+#if defined(_WIN32)
+#  define WIDECHAR
+#endif
+
 #ifdef WINAPI_FAMILY
 #  define open _open
 #  define read _read
@@ -95,18 +103,19 @@
 #  endif
 #endif
 
-/* unlike snprintf (which is required in C99, yet still not supported by
-   Microsoft more than a decade later!), _snprintf does not guarantee null
-   termination of the result -- however this is only used in gzlib.c where
+/* unlike snprintf (which is required in C99), _snprintf does not guarantee
+   null termination of the result -- however this is only used in gzlib.c where
    the result is assured to fit in the space provided */
-#ifdef _MSC_VER
+#if defined(_MSC_VER) && _MSC_VER < 1900
 #  define snprintf _snprintf
 #endif
 
 #ifndef local
 #  define local static
 #endif
-/* compile with -Dlocal if your debugger can't find static symbols */
+/* since "static" is used to mean two completely different things in C, we
+   define "local" for the non-static meaning of "static", for readability
+   (compile with -Dlocal if your debugger can't find static symbols) */
 
 /* gz* functions always use library allocation functions */
 #ifndef STDC
@@ -170,7 +179,7 @@ typedef struct {
     char *path;             /* path or fd for error messages */
     unsigned size;          /* buffer size, zero if not allocated yet */
     unsigned want;          /* requested buffer size, default is GZBUFSIZE */
-    unsigned char *in;      /* input buffer */
+    unsigned char *in;      /* input buffer (double-sized when writing) */
     unsigned char *out;     /* output buffer (double-sized when reading) */
     int direct;             /* 0 if processing gzip, 1 if transparent */
         /* just for reading */
@@ -181,6 +190,7 @@ typedef struct {
         /* just for writing */
     int level;              /* compression level */
     int strategy;           /* compression strategy */
+    int reset;              /* true if a reset is pending after a Z_FINISH */
         /* seek request */
     z_off64_t skip;         /* amount to skip (already rewound if backwards) */
     int seek;               /* true if seek request pending */

modules/zlib/src/gzlib.c

@@ -1,5 +1,5 @@
 /* gzlib.c -- zlib functions common to reading and writing gzip files
- * Copyright (C) 2004, 2010, 2011, 2012, 2013 Mark Adler
+ * Copyright (C) 2004-2019 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -81,6 +81,8 @@ local void gz_reset(state)
         state->past = 0;            /* have not read past end yet */
         state->how = LOOK;          /* look for gzip header */
     }
+    else                            /* for writing ... */
+        state->reset = 0;           /* no deflateReset pending */
     state->seek = 0;                /* no seek request pending */
     gz_error(state, Z_OK, NULL);    /* clear error */
     state->x.pos = 0;               /* no uncompressed data yet */
@@ -94,7 +96,7 @@ local gzFile gz_open(path, fd, mode)
     const char *mode;
 {
     gz_statep state;
-    size_t len;
+    z_size_t len;
     int oflag;
 #ifdef O_CLOEXEC
     int cloexec = 0;
@@ -188,10 +190,10 @@ local gzFile gz_open(path, fd, mode)
     }
 
     /* save the path name for error messages */
-#ifdef _WIN32
+#ifdef WIDECHAR
     if (fd == -2) {
         len = wcstombs(NULL, path, 0);
-        if (len == (size_t)-1)
+        if (len == (z_size_t)-1)
             len = 0;
     }
     else
@@ -202,7 +204,7 @@ local gzFile gz_open(path, fd, mode)
         free(state);
         return NULL;
     }
-#ifdef _WIN32
+#ifdef WIDECHAR
     if (fd == -2)
         if (len)
             wcstombs(state->path, path, len + 1);
@@ -211,7 +213,7 @@ local gzFile gz_open(path, fd, mode)
     else
 #endif
 #if !defined(NO_snprintf) && !defined(NO_vsnprintf)
-        snprintf(state->path, len + 1, "%s", (const char *)path);
+        (void)snprintf(state->path, len + 1, "%s", (const char *)path);
 #else
         strcpy(state->path, path);
 #endif
@@ -239,7 +241,7 @@ local gzFile gz_open(path, fd, mode)
 
     /* open the file with the appropriate flags (or just use fd) */
     state->fd = fd > -1 ? fd : (
-#ifdef _WIN32
+#ifdef WIDECHAR
         fd == -2 ? _wopen(path, oflag, 0666) :
 #endif
         open((const char *)path, oflag, 0666));
@@ -248,8 +250,10 @@ local gzFile gz_open(path, fd, mode)
         free(state);
         return NULL;
     }
-    if (state->mode == GZ_APPEND)
+    if (state->mode == GZ_APPEND) {
+        LSEEK(state->fd, 0, SEEK_END);  /* so gzoffset() is correct */
         state->mode = GZ_WRITE;         /* simplify later checks */
+    }
 
     /* save the current position for rewinding (only if reading) */
     if (state->mode == GZ_READ) {
@@ -291,7 +295,7 @@ gzFile ZEXPORT gzdopen(fd, mode)
     if (fd == -1 || (path = (char *)malloc(7 + 3 * sizeof(int))) == NULL)
         return NULL;
 #if !defined(NO_snprintf) && !defined(NO_vsnprintf)
-    snprintf(path, 7 + 3 * sizeof(int), "<fd:%d>", fd); /* for debugging */
+    (void)snprintf(path, 7 + 3 * sizeof(int), "<fd:%d>", fd);
 #else
     sprintf(path, "<fd:%d>", fd);   /* for debugging */
 #endif
@@ -301,7 +305,7 @@ gzFile ZEXPORT gzdopen(fd, mode)
 }
 
 /* -- see zlib.h -- */
-#ifdef _WIN32
+#ifdef WIDECHAR
 gzFile ZEXPORT gzopen_w(path, mode)
     const wchar_t *path;
     const char *mode;
@@ -329,6 +333,8 @@ int ZEXPORT gzbuffer(file, size)
         return -1;
 
     /* check and set requested size */
+    if ((size << 1) < size)
+        return -1;              /* need to be able to double it */
     if (size < 2)
         size = 2;               /* need two bytes to check magic header */
     state->want = size;
@@ -393,7 +399,7 @@ z_off64_t ZEXPORT gzseek64(file, offset, whence)
     /* if within raw area while reading, just go there */
     if (state->mode == GZ_READ && state->how == COPY &&
             state->x.pos + offset >= 0) {
-        ret = LSEEK(state->fd, offset - state->x.have, SEEK_CUR);
+        ret = LSEEK(state->fd, offset - (z_off64_t)state->x.have, SEEK_CUR);
         if (ret == -1)
             return -1;
         state->x.have = 0;
@@ -604,14 +610,13 @@ void ZLIB_INTERNAL gz_error(state, err, msg)
         return;
     }
 #if !defined(NO_snprintf) && !defined(NO_vsnprintf)
-    snprintf(state->msg, strlen(state->path) + strlen(msg) + 3,
-             "%s%s%s", state->path, ": ", msg);
+    (void)snprintf(state->msg, strlen(state->path) + strlen(msg) + 3,
+                   "%s%s%s", state->path, ": ", msg);
 #else
     strcpy(state->msg, state->path);
     strcat(state->msg, ": ");
     strcat(state->msg, msg);
 #endif
-    return;
 }
 
 #ifndef INT_MAX

modules/zlib/src/gzread.c

@@ -1,5 +1,5 @@
 /* gzread.c -- zlib functions for reading gzip files
- * Copyright (C) 2004, 2005, 2010, 2011, 2012, 2013 Mark Adler
+ * Copyright (C) 2004-2017 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -15,6 +15,7 @@ local int gz_look OF((gz_statep));
 local int gz_decomp OF((gz_statep));
 local int gz_fetch OF((gz_statep));
 local int gz_skip OF((gz_statep, z_off64_t));
+local z_size_t gz_read OF((gz_statep, voidp, z_size_t));
 
 /* Use read() to load a buffer -- return -1 on error, otherwise 0.  Read from
    state->fd, and update state->eof, state->err, and state->msg as appropriate.
@@ -27,13 +28,17 @@ local int gz_load(state, buf, len, have)
     unsigned *have;
 {
     int ret;
+    unsigned get, max = ((unsigned)-1 >> 2) + 1;
 
     *have = 0;
     do {
-        ret = read(state->fd, buf + *have, len - *have);
+        get = len - *have;
+        if (get > max)
+            get = max;
+        ret = read(state->fd, buf + *have, get);
         if (ret <= 0)
             break;
-        *have += ret;
+        *have += (unsigned)ret;
     } while (*have < len);
     if (ret < 0) {
         gz_error(state, Z_ERRNO, zstrerror());
@@ -97,10 +102,8 @@ local int gz_look(state)
         state->in = (unsigned char *)malloc(state->want);
         state->out = (unsigned char *)malloc(state->want << 1);
         if (state->in == NULL || state->out == NULL) {
-            if (state->out != NULL)
-                free(state->out);
-            if (state->in != NULL)
-                free(state->in);
+            free(state->out);
+            free(state->in);
             gz_error(state, Z_MEM_ERROR, "out of memory");
             return -1;
         }
@@ -287,33 +290,17 @@ local int gz_skip(state, len)
     return 0;
 }
 
-/* -- see zlib.h -- */
-int ZEXPORT gzread(file, buf, len)
-    gzFile file;
-    voidp buf;
-    unsigned len;
-{
-    unsigned got, n;
+/* Read len bytes into buf from file, or less than len up to the end of the
+   input.  Return the number of bytes read.  If zero is returned, either the
+   end of file was reached, or there was an error.  state->err must be
+   consulted in that case to determine which. */
+local z_size_t gz_read(state, buf, len)
     gz_statep state;
-    z_streamp strm;
-
-    /* get internal structure */
-    if (file == NULL)
-        return -1;
-    state = (gz_statep)file;
-    strm = &(state->strm);
-
-    /* check that we're reading and that there's no (serious) error */
-    if (state->mode != GZ_READ ||
-            (state->err != Z_OK && state->err != Z_BUF_ERROR))
-        return -1;
-
-    /* since an int is returned, make sure len fits in one, otherwise return
-       with an error (this avoids the flaw in the interface) */
-    if ((int)len < 0) {
-        gz_error(state, Z_DATA_ERROR, "requested length does not fit in int");
-        return -1;
-    }
+    voidp buf;
+    z_size_t len;
+{
+    z_size_t got;
+    unsigned n;
 
     /* if len is zero, avoid unnecessary operations */
     if (len == 0)
@@ -323,32 +310,38 @@ int ZEXPORT gzread(file, buf, len)
     if (state->seek) {
         state->seek = 0;
         if (gz_skip(state, state->skip) == -1)
-            return -1;
+            return 0;
     }
 
     /* get len bytes to buf, or less than len if at the end */
     got = 0;
     do {
+        /* set n to the maximum amount of len that fits in an unsigned int */
+        n = (unsigned)-1;
+        if (n > len)
+            n = (unsigned)len;
+
         /* first just try copying data from the output buffer */
         if (state->x.have) {
-            n = state->x.have > len ? len : state->x.have;
+            if (state->x.have < n)
+                n = state->x.have;
             memcpy(buf, state->x.next, n);
             state->x.next += n;
             state->x.have -= n;
         }
 
         /* output buffer empty -- return if we're at the end of the input */
-        else if (state->eof && strm->avail_in == 0) {
+        else if (state->eof && state->strm.avail_in == 0) {
             state->past = 1;        /* tried to read past end */
             break;
         }
 
         /* need output data -- for small len or new stream load up our output
            buffer */
-        else if (state->how == LOOK || len < (state->size << 1)) {
+        else if (state->how == LOOK || n < (state->size << 1)) {
             /* get more output, looking for header if required */
             if (gz_fetch(state) == -1)
-                return -1;
+                return 0;
             continue;       /* no progress yet -- go back to copy above */
             /* the copy above assures that we will leave with space in the
                output buffer, allowing at least one gzungetc() to succeed */
@@ -356,16 +349,16 @@ int ZEXPORT gzread(file, buf, len)
 
         /* large len -- read directly into user buffer */
         else if (state->how == COPY) {      /* read directly */
-            if (gz_load(state, (unsigned char *)buf, len, &n) == -1)
-                return -1;
+            if (gz_load(state, (unsigned char *)buf, n, &n) == -1)
+                return 0;
         }
 
         /* large len -- decompress directly into user buffer */
         else {  /* state->how == GZIP */
-            strm->avail_out = len;
-            strm->next_out = (unsigned char *)buf;
+            state->strm.avail_out = n;
+            state->strm.next_out = (unsigned char *)buf;
             if (gz_decomp(state) == -1)
-                return -1;
+                return 0;
             n = state->x.have;
             state->x.have = 0;
         }
@@ -377,8 +370,75 @@ int ZEXPORT gzread(file, buf, len)
         state->x.pos += n;
     } while (len);
 
-    /* return number of bytes read into user buffer (will fit in int) */
-    return (int)got;
+    /* return number of bytes read into user buffer */
+    return got;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzread(file, buf, len)
+    gzFile file;
+    voidp buf;
+    unsigned len;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+            (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return -1;
+
+    /* since an int is returned, make sure len fits in one, otherwise return
+       with an error (this avoids a flaw in the interface) */
+    if ((int)len < 0) {
+        gz_error(state, Z_STREAM_ERROR, "request does not fit in an int");
+        return -1;
+    }
+
+    /* read len or fewer bytes to buf */
+    len = (unsigned)gz_read(state, buf, len);
+
+    /* check for an error */
+    if (len == 0 && state->err != Z_OK && state->err != Z_BUF_ERROR)
+        return -1;
+
+    /* return the number of bytes read (this is assured to fit in an int) */
+    return (int)len;
+}
+
+/* -- see zlib.h -- */
+z_size_t ZEXPORT gzfread(buf, size, nitems, file)
+    voidp buf;
+    z_size_t size;
+    z_size_t nitems;
+    gzFile file;
+{
+    z_size_t len;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* check that we're reading and that there's no (serious) error */
+    if (state->mode != GZ_READ ||
+            (state->err != Z_OK && state->err != Z_BUF_ERROR))
+        return 0;
+
+    /* compute bytes to read -- error on overflow */
+    len = nitems * size;
+    if (size && len / size != nitems) {
+        gz_error(state, Z_STREAM_ERROR, "request does not fit in a size_t");
+        return 0;
+    }
+
+    /* read len or fewer bytes to buf, return the number of full items read */
+    return len ? gz_read(state, buf, len) / size : 0;
 }
 
 /* -- see zlib.h -- */
@@ -390,7 +450,6 @@ int ZEXPORT gzread(file, buf, len)
 int ZEXPORT gzgetc(file)
     gzFile file;
 {
-    int ret;
     unsigned char buf[1];
     gz_statep state;
 
@@ -411,9 +470,8 @@ int ZEXPORT gzgetc(file)
         return *(state->x.next)++;
     }
 
-    /* nothing there -- try gzread() */
-    ret = gzread(file, buf, 1);
-    return ret < 1 ? -1 : buf[0];
+    /* nothing there -- try gz_read() */
+    return gz_read(state, buf, 1) < 1 ? -1 : buf[0];
 }
 
 int ZEXPORT gzgetc_(file)
@@ -454,7 +512,7 @@ int ZEXPORT gzungetc(c, file)
     if (state->x.have == 0) {
         state->x.have = 1;
         state->x.next = state->out + (state->size << 1) - 1;
-        state->x.next[0] = c;
+        state->x.next[0] = (unsigned char)c;
         state->x.pos--;
         state->past = 0;
         return c;
@@ -476,7 +534,7 @@ int ZEXPORT gzungetc(c, file)
     }
     state->x.have++;
     state->x.next--;
-    state->x.next[0] = c;
+    state->x.next[0] = (unsigned char)c;
     state->x.pos--;
     state->past = 0;
     return c;

modules/zlib/src/gzwrite.c

@@ -1,5 +1,5 @@
 /* gzwrite.c -- zlib functions for writing gzip files
- * Copyright (C) 2004, 2005, 2010, 2011, 2012, 2013 Mark Adler
+ * Copyright (C) 2004-2019 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -9,17 +9,19 @@
 local int gz_init OF((gz_statep));
 local int gz_comp OF((gz_statep, int));
 local int gz_zero OF((gz_statep, z_off64_t));
+local z_size_t gz_write OF((gz_statep, voidpc, z_size_t));
 
 /* Initialize state for writing a gzip file.  Mark initialization by setting
-   state->size to non-zero.  Return -1 on failure or 0 on success. */
+   state->size to non-zero.  Return -1 on a memory allocation failure, or 0 on
+   success. */
 local int gz_init(state)
     gz_statep state;
 {
     int ret;
     z_streamp strm = &(state->strm);
 
-    /* allocate input buffer */
-    state->in = (unsigned char *)malloc(state->want);
+    /* allocate input buffer (double size for gzprintf) */
+    state->in = (unsigned char *)malloc(state->want << 1);
     if (state->in == NULL) {
         gz_error(state, Z_MEM_ERROR, "out of memory");
         return -1;
@@ -47,6 +49,7 @@ local int gz_init(state)
             gz_error(state, Z_MEM_ERROR, "out of memory");
             return -1;
         }
+        strm->next_in = NULL;
     }
 
     /* mark state as initialized */
@@ -62,17 +65,17 @@ local int gz_init(state)
 }
 
 /* Compress whatever is at avail_in and next_in and write to the output file.
-   Return -1 if there is an error writing to the output file, otherwise 0.
-   flush is assumed to be a valid deflate() flush value.  If flush is Z_FINISH,
-   then the deflate() state is reset to start a new gzip stream.  If gz->direct
-   is true, then simply write to the output file without compressing, and
-   ignore flush. */
+   Return -1 if there is an error writing to the output file or if gz_init()
+   fails to allocate memory, otherwise 0.  flush is assumed to be a valid
+   deflate() flush value.  If flush is Z_FINISH, then the deflate() state is
+   reset to start a new gzip stream.  If gz->direct is true, then simply write
+   to the output file without compressing, and ignore flush. */
 local int gz_comp(state, flush)
     gz_statep state;
     int flush;
 {
-    int ret, got;
-    unsigned have;
+    int ret, writ;
+    unsigned have, put, max = ((unsigned)-1 >> 2) + 1;
     z_streamp strm = &(state->strm);
 
     /* allocate memory if this is the first time through */
@@ -81,15 +84,28 @@ local int gz_comp(state, flush)
 
     /* write directly if requested */
     if (state->direct) {
-        got = write(state->fd, strm->next_in, strm->avail_in);
-        if (got < 0 || (unsigned)got != strm->avail_in) {
-            gz_error(state, Z_ERRNO, zstrerror());
-            return -1;
+        while (strm->avail_in) {
+            put = strm->avail_in > max ? max : strm->avail_in;
+            writ = write(state->fd, strm->next_in, put);
+            if (writ < 0) {
+                gz_error(state, Z_ERRNO, zstrerror());
+                return -1;
+            }
+            strm->avail_in -= (unsigned)writ;
+            strm->next_in += writ;
         }
-        strm->avail_in = 0;
         return 0;
     }
 
+    /* check for a pending reset */
+    if (state->reset) {
+        /* don't start a new gzip member unless there is data to write */
+        if (strm->avail_in == 0)
+            return 0;
+        deflateReset(strm);
+        state->reset = 0;
+    }
+
     /* run deflate() on provided input until it produces no more output */
     ret = Z_OK;
     do {
@@ -97,17 +113,21 @@ local int gz_comp(state, flush)
            doing Z_FINISH then don't write until we get to Z_STREAM_END */
         if (strm->avail_out == 0 || (flush != Z_NO_FLUSH &&
             (flush != Z_FINISH || ret == Z_STREAM_END))) {
-            have = (unsigned)(strm->next_out - state->x.next);
-            if (have && ((got = write(state->fd, state->x.next, have)) < 0 ||
-                         (unsigned)got != have)) {
-                gz_error(state, Z_ERRNO, zstrerror());
-                return -1;
+            while (strm->next_out > state->x.next) {
+                put = strm->next_out - state->x.next > (int)max ? max :
+                      (unsigned)(strm->next_out - state->x.next);
+                writ = write(state->fd, state->x.next, put);
+                if (writ < 0) {
+                    gz_error(state, Z_ERRNO, zstrerror());
+                    return -1;
+                }
+                state->x.next += writ;
             }
             if (strm->avail_out == 0) {
                 strm->avail_out = state->size;
                 strm->next_out = state->out;
+                state->x.next = state->out;
             }
-            state->x.next = strm->next_out;
         }
 
         /* compress */
@@ -123,13 +143,14 @@ local int gz_comp(state, flush)
 
     /* if that completed a deflate stream, allow another to start */
     if (flush == Z_FINISH)
-        deflateReset(strm);
+        state->reset = 1;
 
     /* all done, no errors */
     return 0;
 }
 
-/* Compress len zeros to output.  Return -1 on error, 0 on success. */
+/* Compress len zeros to output.  Return -1 on a write error or memory
+   allocation failure by gz_comp(), or 0 on success. */
 local int gz_zero(state, len)
     gz_statep state;
     z_off64_t len;
@@ -161,32 +182,14 @@ local int gz_zero(state, len)
     return 0;
 }
 
-/* -- see zlib.h -- */
-int ZEXPORT gzwrite(file, buf, len)
-    gzFile file;
-    voidpc buf;
-    unsigned len;
-{
-    unsigned put = len;
+/* Write len bytes from buf to file.  Return the number of bytes written.  If
+   the returned value is less than len, then there was an error. */
+local z_size_t gz_write(state, buf, len)
     gz_statep state;
-    z_streamp strm;
-
-    /* get internal structure */
-    if (file == NULL)
-        return 0;
-    state = (gz_statep)file;
-    strm = &(state->strm);
-
-    /* check that we're writing and that there's no error */
-    if (state->mode != GZ_WRITE || state->err != Z_OK)
-        return 0;
-
-    /* since an int is returned, make sure len fits in one, otherwise return
-       with an error (this avoids the flaw in the interface) */
-    if ((int)len < 0) {
-        gz_error(state, Z_DATA_ERROR, "requested length does not fit in int");
-        return 0;
-    }
+    voidpc buf;
+    z_size_t len;
+{
+    z_size_t put = len;
 
     /* if len is zero, avoid unnecessary operations */
     if (len == 0)
@@ -209,14 +212,15 @@ int ZEXPORT gzwrite(file, buf, len)
         do {
             unsigned have, copy;
 
-            if (strm->avail_in == 0)
-                strm->next_in = state->in;
-            have = (unsigned)((strm->next_in + strm->avail_in) - state->in);
+            if (state->strm.avail_in == 0)
+                state->strm.next_in = state->in;
+            have = (unsigned)((state->strm.next_in + state->strm.avail_in) -
+                              state->in);
             copy = state->size - have;
             if (copy > len)
-                copy = len;
+                copy = (unsigned)len;
             memcpy(state->in + have, buf, copy);
-            strm->avail_in += copy;
+            state->strm.avail_in += copy;
             state->x.pos += copy;
             buf = (const char *)buf + copy;
             len -= copy;
@@ -226,19 +230,83 @@ int ZEXPORT gzwrite(file, buf, len)
     }
     else {
         /* consume whatever's left in the input buffer */
-        if (strm->avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
+        if (state->strm.avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
             return 0;
 
         /* directly compress user buffer to file */
-        strm->avail_in = len;
-        strm->next_in = (z_const Bytef *)buf;
-        state->x.pos += len;
-        if (gz_comp(state, Z_NO_FLUSH) == -1)
-            return 0;
+        state->strm.next_in = (z_const Bytef *)buf;
+        do {
+            unsigned n = (unsigned)-1;
+            if (n > len)
+                n = (unsigned)len;
+            state->strm.avail_in = n;
+            state->x.pos += n;
+            if (gz_comp(state, Z_NO_FLUSH) == -1)
+                return 0;
+            len -= n;
+        } while (len);
     }
 
-    /* input was all buffered or compressed (put will fit in int) */
-    return (int)put;
+    /* input was all buffered or compressed */
+    return put;
+}
+
+/* -- see zlib.h -- */
+int ZEXPORT gzwrite(file, buf, len)
+    gzFile file;
+    voidpc buf;
+    unsigned len;
+{
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return 0;
+
+    /* since an int is returned, make sure len fits in one, otherwise return
+       with an error (this avoids a flaw in the interface) */
+    if ((int)len < 0) {
+        gz_error(state, Z_DATA_ERROR, "requested length does not fit in int");
+        return 0;
+    }
+
+    /* write len bytes from buf (the return value will fit in an int) */
+    return (int)gz_write(state, buf, len);
+}
+
+/* -- see zlib.h -- */
+z_size_t ZEXPORT gzfwrite(buf, size, nitems, file)
+    voidpc buf;
+    z_size_t size;
+    z_size_t nitems;
+    gzFile file;
+{
+    z_size_t len;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return 0;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return 0;
+
+    /* compute bytes to read -- error on overflow */
+    len = nitems * size;
+    if (size && len / size != nitems) {
+        gz_error(state, Z_STREAM_ERROR, "request does not fit in a size_t");
+        return 0;
+    }
+
+    /* write len bytes to buf, return the number of full items written */
+    return len ? gz_write(state, buf, len) / size : 0;
 }
 
 /* -- see zlib.h -- */
@@ -275,7 +343,7 @@ int ZEXPORT gzputc(file, c)
             strm->next_in = state->in;
         have = (unsigned)((strm->next_in + strm->avail_in) - state->in);
         if (have < state->size) {
-            state->in[have] = c;
+            state->in[have] = (unsigned char)c;
             strm->avail_in++;
             state->x.pos++;
             return c & 0xff;
@@ -283,24 +351,37 @@ int ZEXPORT gzputc(file, c)
     }
 
     /* no room in buffer or not initialized, use gz_write() */
-    buf[0] = c;
-    if (gzwrite(file, buf, 1) != 1)
+    buf[0] = (unsigned char)c;
+    if (gz_write(state, buf, 1) != 1)
         return -1;
     return c & 0xff;
 }
 
 /* -- see zlib.h -- */
-int ZEXPORT gzputs(file, str)
+int ZEXPORT gzputs(file, s)
     gzFile file;
-    const char *str;
+    const char *s;
 {
-    int ret;
-    unsigned len;
+    z_size_t len, put;
+    gz_statep state;
+
+    /* get internal structure */
+    if (file == NULL)
+        return -1;
+    state = (gz_statep)file;
+
+    /* check that we're writing and that there's no error */
+    if (state->mode != GZ_WRITE || state->err != Z_OK)
+        return -1;
 
     /* write string */
-    len = (unsigned)strlen(str);
-    ret = gzwrite(file, str, len);
-    return ret == 0 && len != 0 ? -1 : ret;
+    len = strlen(s);
+    if ((int)len < 0 || (unsigned)len != len) {
+        gz_error(state, Z_STREAM_ERROR, "string length does not fit in int");
+        return -1;
+    }
+    put = gz_write(state, s, len);
+    return put < len ? -1 : (int)len;
 }
 
 #if defined(STDC) || defined(Z_HAVE_STDARG_H)
@@ -309,63 +390,73 @@ int ZEXPORT gzputs(file, str)
 /* -- see zlib.h -- */
 int ZEXPORTVA gzvprintf(gzFile file, const char *format, va_list va)
 {
-    int size, len;
+    int len;
+    unsigned left;
+    char *next;
     gz_statep state;
     z_streamp strm;
 
     /* get internal structure */
     if (file == NULL)
-        return -1;
+        return Z_STREAM_ERROR;
     state = (gz_statep)file;
     strm = &(state->strm);
 
     /* check that we're writing and that there's no error */
     if (state->mode != GZ_WRITE || state->err != Z_OK)
-        return 0;
+        return Z_STREAM_ERROR;
 
     /* make sure we have some buffer space */
     if (state->size == 0 && gz_init(state) == -1)
-        return 0;
+        return state->err;
 
     /* check for seek request */
     if (state->seek) {
         state->seek = 0;
         if (gz_zero(state, state->skip) == -1)
-            return 0;
+            return state->err;
     }
 
-    /* consume whatever's left in the input buffer */
-    if (strm->avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
-        return 0;
-
-    /* do the printf() into the input buffer, put length in len */
-    size = (int)(state->size);
-    state->in[size - 1] = 0;
+    /* do the printf() into the input buffer, put length in len -- the input
+       buffer is double-sized just for this function, so there is guaranteed to
+       be state->size bytes available after the current contents */
+    if (strm->avail_in == 0)
+        strm->next_in = state->in;
+    next = (char *)(state->in + (strm->next_in - state->in) + strm->avail_in);
+    next[state->size - 1] = 0;
 #ifdef NO_vsnprintf
 #  ifdef HAS_vsprintf_void
-    (void)vsprintf((char *)(state->in), format, va);
-    for (len = 0; len < size; len++)
-        if (state->in[len] == 0) break;
+    (void)vsprintf(next, format, va);
+    for (len = 0; len < state->size; len++)
+        if (next[len] == 0) break;
 #  else
-    len = vsprintf((char *)(state->in), format, va);
+    len = vsprintf(next, format, va);
 #  endif
 #else
 #  ifdef HAS_vsnprintf_void
-    (void)vsnprintf((char *)(state->in), size, format, va);
-    len = strlen((char *)(state->in));
+    (void)vsnprintf(next, state->size, format, va);
+    len = strlen(next);
 #  else
-    len = vsnprintf((char *)(state->in), size, format, va);
+    len = vsnprintf(next, state->size, format, va);
 #  endif
 #endif
 
     /* check that printf() results fit in buffer */
-    if (len <= 0 || len >= (int)size || state->in[size - 1] != 0)
+    if (len == 0 || (unsigned)len >= state->size || next[state->size - 1] != 0)
         return 0;
 
-    /* update buffer and position, defer compression until needed */
-    strm->avail_in = (unsigned)len;
-    strm->next_in = state->in;
+    /* update buffer and position, compress first half if past that */
+    strm->avail_in += (unsigned)len;
     state->x.pos += len;
+    if (strm->avail_in >= state->size) {
+        left = strm->avail_in - state->size;
+        strm->avail_in = state->size;
+        if (gz_comp(state, Z_NO_FLUSH) == -1)
+            return state->err;
+        memmove(state->in, state->in + state->size, left);
+        strm->next_in = state->in;
+        strm->avail_in = left;
+    }
     return len;
 }
 
@@ -390,73 +481,82 @@ int ZEXPORTVA gzprintf (file, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10,
     int a1, a2, a3, a4, a5, a6, a7, a8, a9, a10,
         a11, a12, a13, a14, a15, a16, a17, a18, a19, a20;
 {
-    int size, len;
+    unsigned len, left;
+    char *next;
     gz_statep state;
     z_streamp strm;
 
     /* get internal structure */
     if (file == NULL)
-        return -1;
+        return Z_STREAM_ERROR;
     state = (gz_statep)file;
     strm = &(state->strm);
 
     /* check that can really pass pointer in ints */
     if (sizeof(int) != sizeof(void *))
-        return 0;
+        return Z_STREAM_ERROR;
 
     /* check that we're writing and that there's no error */
     if (state->mode != GZ_WRITE || state->err != Z_OK)
-        return 0;
+        return Z_STREAM_ERROR;
 
     /* make sure we have some buffer space */
     if (state->size == 0 && gz_init(state) == -1)
-        return 0;
+        return state->error;
 
     /* check for seek request */
     if (state->seek) {
         state->seek = 0;
         if (gz_zero(state, state->skip) == -1)
-            return 0;
+            return state->error;
     }
 
-    /* consume whatever's left in the input buffer */
-    if (strm->avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
-        return 0;
-
-    /* do the printf() into the input buffer, put length in len */
-    size = (int)(state->size);
-    state->in[size - 1] = 0;
+    /* do the printf() into the input buffer, put length in len -- the input
+       buffer is double-sized just for this function, so there is guaranteed to
+       be state->size bytes available after the current contents */
+    if (strm->avail_in == 0)
+        strm->next_in = state->in;
+    next = (char *)(strm->next_in + strm->avail_in);
+    next[state->size - 1] = 0;
 #ifdef NO_snprintf
 #  ifdef HAS_sprintf_void
-    sprintf((char *)(state->in), format, a1, a2, a3, a4, a5, a6, a7, a8,
-            a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
+    sprintf(next, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12,
+            a13, a14, a15, a16, a17, a18, a19, a20);
     for (len = 0; len < size; len++)
-        if (state->in[len] == 0) break;
+        if (next[len] == 0)
+            break;
 #  else
-    len = sprintf((char *)(state->in), format, a1, a2, a3, a4, a5, a6, a7, a8,
-                  a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
+    len = sprintf(next, format, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11,
+                  a12, a13, a14, a15, a16, a17, a18, a19, a20);
 #  endif
 #else
 #  ifdef HAS_snprintf_void
-    snprintf((char *)(state->in), size, format, a1, a2, a3, a4, a5, a6, a7, a8,
-             a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
-    len = strlen((char *)(state->in));
+    snprintf(next, state->size, format, a1, a2, a3, a4, a5, a6, a7, a8, a9,
+             a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
+    len = strlen(next);
 #  else
-    len = snprintf((char *)(state->in), size, format, a1, a2, a3, a4, a5, a6,
-                   a7, a8, a9, a10, a11, a12, a13, a14, a15, a16, a17, a18,
-                   a19, a20);
+    len = snprintf(next, state->size, format, a1, a2, a3, a4, a5, a6, a7, a8,
+                   a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19, a20);
 #  endif
 #endif
 
     /* check that printf() results fit in buffer */
-    if (len <= 0 || len >= (int)size || state->in[size - 1] != 0)
+    if (len == 0 || len >= state->size || next[state->size - 1] != 0)
         return 0;
 
-    /* update buffer and position, defer compression until needed */
-    strm->avail_in = (unsigned)len;
-    strm->next_in = state->in;
+    /* update buffer and position, compress first half if past that */
+    strm->avail_in += len;
     state->x.pos += len;
-    return len;
+    if (strm->avail_in >= state->size) {
+        left = strm->avail_in - state->size;
+        strm->avail_in = state->size;
+        if (gz_comp(state, Z_NO_FLUSH) == -1)
+            return state->err;
+        memmove(state->in, state->in + state->size, left);
+        strm->next_in = state->in;
+        strm->avail_in = left;
+    }
+    return (int)len;
 }
 
 #endif
@@ -470,7 +570,7 @@ int ZEXPORT gzflush(file, flush)
 
     /* get internal structure */
     if (file == NULL)
-        return -1;
+        return Z_STREAM_ERROR;
     state = (gz_statep)file;
 
     /* check that we're writing and that there's no error */
@@ -485,11 +585,11 @@ int ZEXPORT gzflush(file, flush)
     if (state->seek) {
         state->seek = 0;
         if (gz_zero(state, state->skip) == -1)
-            return -1;
+            return state->err;
     }
 
     /* compress remaining data with requested flush */
-    gz_comp(state, flush);
+    (void)gz_comp(state, flush);
     return state->err;
 }
 
@@ -520,13 +620,13 @@ int ZEXPORT gzsetparams(file, level, strategy)
     if (state->seek) {
         state->seek = 0;
         if (gz_zero(state, state->skip) == -1)
-            return -1;
+            return state->err;
     }
 
     /* change compression parameters for subsequent input */
     if (state->size) {
         /* flush previous input with previous parameters before changing */
-        if (strm->avail_in && gz_comp(state, Z_PARTIAL_FLUSH) == -1)
+        if (strm->avail_in && gz_comp(state, Z_BLOCK) == -1)
             return state->err;
         deflateParams(strm, level, strategy);
     }

modules/zlib/src/infback.c

@@ -1,5 +1,5 @@
 /* infback.c -- inflate using a call-back interface
- * Copyright (C) 1995-2011 Mark Adler
+ * Copyright (C) 1995-2022 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -61,7 +61,7 @@ int stream_size;
     Tracev((stderr, "inflate: allocated\n"));
     strm->state = (struct internal_state FAR *)state;
     state->dmax = 32768U;
-    state->wbits = windowBits;
+    state->wbits = (uInt)windowBits;
     state->wsize = 1U << windowBits;
     state->window = window;
     state->wnext = 0;
@@ -477,6 +477,7 @@ void FAR *out_desc;
             }
             Tracev((stderr, "inflate:       codes ok\n"));
             state->mode = LEN;
+                /* fallthrough */
 
         case LEN:
             /* use inflate_fast() if we have enough input and output */

modules/zlib/src/inffast.c

@@ -1,5 +1,5 @@
 /* inffast.c -- fast decoding
- * Copyright (C) 1995-2008, 2010, 2013 Mark Adler
+ * Copyright (C) 1995-2017 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -8,26 +8,9 @@
 #include "inflate.h"
 #include "inffast.h"
 
-#ifndef ASMINF
-
-/* Allow machine dependent optimization for post-increment or pre-increment.
-   Based on testing to date,
-   Pre-increment preferred for:
-   - PowerPC G3 (Adler)
-   - MIPS R5000 (Randers-Pehrson)
-   Post-increment preferred for:
-   - none
-   No measurable difference:
-   - Pentium III (Anderson)
-   - M68060 (Nikl)
- */
-#ifdef POSTINC
-#  define OFF 0
-#  define PUP(a) *(a)++
+#ifdef ASMINF
+#  pragma message("Assembler code may have bugs -- use at your own risk")
 #else
-#  define OFF 1
-#  define PUP(a) *++(a)
-#endif
 
 /*
    Decode literal, length, and distance codes and write out the resulting
@@ -87,7 +70,7 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
     code const FAR *dcode;      /* local strm->distcode */
     unsigned lmask;             /* mask for first level of length codes */
     unsigned dmask;             /* mask for first level of distance codes */
-    code here;                  /* retrieved table entry */
+    code const *here;           /* retrieved table entry */
     unsigned op;                /* code bits, operation, extra bits, or */
                                 /*  window position, window bytes to copy */
     unsigned len;               /* match length, unused bytes */
@@ -96,9 +79,9 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
 
     /* copy state to local variables */
     state = (struct inflate_state FAR *)strm->state;
-    in = strm->next_in - OFF;
+    in = strm->next_in;
     last = in + (strm->avail_in - 5);
-    out = strm->next_out - OFF;
+    out = strm->next_out;
     beg = out - (start - strm->avail_out);
     end = out + (strm->avail_out - 257);
 #ifdef INFLATE_STRICT
@@ -119,29 +102,29 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
        input data or output space */
     do {
         if (bits < 15) {
-            hold += (unsigned long)(PUP(in)) << bits;
+            hold += (unsigned long)(*in++) << bits;
             bits += 8;
-            hold += (unsigned long)(PUP(in)) << bits;
+            hold += (unsigned long)(*in++) << bits;
             bits += 8;
         }
-        here = lcode[hold & lmask];
+        here = lcode + (hold & lmask);
       dolen:
-        op = (unsigned)(here.bits);
+        op = (unsigned)(here->bits);
         hold >>= op;
         bits -= op;
-        op = (unsigned)(here.op);
+        op = (unsigned)(here->op);
         if (op == 0) {                          /* literal */
-            Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
+            Tracevv((stderr, here->val >= 0x20 && here->val < 0x7f ?
                     "inflate:         literal '%c'\n" :
-                    "inflate:         literal 0x%02x\n", here.val));
-            PUP(out) = (unsigned char)(here.val);
+                    "inflate:         literal 0x%02x\n", here->val));
+            *out++ = (unsigned char)(here->val);
         }
         else if (op & 16) {                     /* length base */
-            len = (unsigned)(here.val);
+            len = (unsigned)(here->val);
             op &= 15;                           /* number of extra bits */
             if (op) {
                 if (bits < op) {
-                    hold += (unsigned long)(PUP(in)) << bits;
+                    hold += (unsigned long)(*in++) << bits;
                     bits += 8;
                 }
                 len += (unsigned)hold & ((1U << op) - 1);
@@ -150,25 +133,25 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
             }
             Tracevv((stderr, "inflate:         length %u\n", len));
             if (bits < 15) {
-                hold += (unsigned long)(PUP(in)) << bits;
+                hold += (unsigned long)(*in++) << bits;
                 bits += 8;
-                hold += (unsigned long)(PUP(in)) << bits;
+                hold += (unsigned long)(*in++) << bits;
                 bits += 8;
             }
-            here = dcode[hold & dmask];
+            here = dcode + (hold & dmask);
           dodist:
-            op = (unsigned)(here.bits);
+            op = (unsigned)(here->bits);
             hold >>= op;
             bits -= op;
-            op = (unsigned)(here.op);
+            op = (unsigned)(here->op);
             if (op & 16) {                      /* distance base */
-                dist = (unsigned)(here.val);
+                dist = (unsigned)(here->val);
                 op &= 15;                       /* number of extra bits */
                 if (bits < op) {
-                    hold += (unsigned long)(PUP(in)) << bits;
+                    hold += (unsigned long)(*in++) << bits;
                     bits += 8;
                     if (bits < op) {
-                        hold += (unsigned long)(PUP(in)) << bits;
+                        hold += (unsigned long)(*in++) << bits;
                         bits += 8;
                     }
                 }
@@ -196,30 +179,30 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
 #ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
                         if (len <= op - whave) {
                             do {
-                                PUP(out) = 0;
+                                *out++ = 0;
                             } while (--len);
                             continue;
                         }
                         len -= op - whave;
                         do {
-                            PUP(out) = 0;
+                            *out++ = 0;
                         } while (--op > whave);
                         if (op == 0) {
                             from = out - dist;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--len);
                             continue;
                         }
 #endif
                     }
-                    from = window - OFF;
+                    from = window;
                     if (wnext == 0) {           /* very common case */
                         from += wsize - op;
                         if (op < len) {         /* some from window */
                             len -= op;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--op);
                             from = out - dist;  /* rest from output */
                         }
@@ -230,14 +213,14 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
                         if (op < len) {         /* some from end of window */
                             len -= op;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--op);
-                            from = window - OFF;
+                            from = window;
                             if (wnext < len) {  /* some from start of window */
                                 op = wnext;
                                 len -= op;
                                 do {
-                                    PUP(out) = PUP(from);
+                                    *out++ = *from++;
                                 } while (--op);
                                 from = out - dist;      /* rest from output */
                             }
@@ -248,40 +231,40 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
                         if (op < len) {         /* some from window */
                             len -= op;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--op);
                             from = out - dist;  /* rest from output */
                         }
                     }
                     while (len > 2) {
-                        PUP(out) = PUP(from);
-                        PUP(out) = PUP(from);
-                        PUP(out) = PUP(from);
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        *out++ = *from++;
                         len -= 3;
                     }
                     if (len) {
-                        PUP(out) = PUP(from);
+                        *out++ = *from++;
                         if (len > 1)
-                            PUP(out) = PUP(from);
+                            *out++ = *from++;
                     }
                 }
                 else {
                     from = out - dist;          /* copy direct from output */
                     do {                        /* minimum length is three */
-                        PUP(out) = PUP(from);
-                        PUP(out) = PUP(from);
-                        PUP(out) = PUP(from);
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        *out++ = *from++;
                         len -= 3;
                     } while (len > 2);
                     if (len) {
-                        PUP(out) = PUP(from);
+                        *out++ = *from++;
                         if (len > 1)
-                            PUP(out) = PUP(from);
+                            *out++ = *from++;
                     }
                 }
             }
             else if ((op & 64) == 0) {          /* 2nd level distance code */
-                here = dcode[here.val + (hold & ((1U << op) - 1))];
+                here = dcode + here->val + (hold & ((1U << op) - 1));
                 goto dodist;
             }
             else {
@@ -291,7 +274,7 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
             }
         }
         else if ((op & 64) == 0) {              /* 2nd level length code */
-            here = lcode[here.val + (hold & ((1U << op) - 1))];
+            here = lcode + here->val + (hold & ((1U << op) - 1));
             goto dolen;
         }
         else if (op & 32) {                     /* end-of-block */
@@ -313,8 +296,8 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
     hold &= (1U << bits) - 1;
 
     /* update state and return */
-    strm->next_in = in + OFF;
-    strm->next_out = out + OFF;
+    strm->next_in = in;
+    strm->next_out = out;
     strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
     strm->avail_out = (unsigned)(out < end ?
                                  257 + (end - out) : 257 - (out - end));

modules/zlib/src/inflate.c

@@ -1,5 +1,5 @@
 /* inflate.c -- zlib decompression
- * Copyright (C) 1995-2012 Mark Adler
+ * Copyright (C) 1995-2022 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -92,6 +92,7 @@
 #endif
 
 /* function prototypes */
+local int inflateStateCheck OF((z_streamp strm));
 local void fixedtables OF((struct inflate_state FAR *state));
 local int updatewindow OF((z_streamp strm, const unsigned char FAR *end,
                            unsigned copy));
@@ -101,12 +102,26 @@ local int updatewindow OF((z_streamp strm, const unsigned char FAR *end,
 local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf,
                               unsigned len));
 
+local int inflateStateCheck(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (strm == Z_NULL ||
+        strm->zalloc == (alloc_func)0 || strm->zfree == (free_func)0)
+        return 1;
+    state = (struct inflate_state FAR *)strm->state;
+    if (state == Z_NULL || state->strm != strm ||
+        state->mode < HEAD || state->mode > SYNC)
+        return 1;
+    return 0;
+}
+
 int ZEXPORT inflateResetKeep(strm)
 z_streamp strm;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     strm->total_in = strm->total_out = state->total = 0;
     strm->msg = Z_NULL;
@@ -115,6 +130,7 @@ z_streamp strm;
     state->mode = HEAD;
     state->last = 0;
     state->havedict = 0;
+    state->flags = -1;
     state->dmax = 32768U;
     state->head = Z_NULL;
     state->hold = 0;
@@ -131,7 +147,7 @@ z_streamp strm;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     state->wsize = 0;
     state->whave = 0;
@@ -147,7 +163,7 @@ int windowBits;
     struct inflate_state FAR *state;
 
     /* get the state */
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
 
     /* extract wrap request from windowBits parameter */
@@ -156,7 +172,7 @@ int windowBits;
         windowBits = -windowBits;
     }
     else {
-        wrap = (windowBits >> 4) + 1;
+        wrap = (windowBits >> 4) + 5;
 #ifdef GUNZIP
         if (windowBits < 48)
             windowBits &= 15;
@@ -210,7 +226,9 @@ int stream_size;
     if (state == Z_NULL) return Z_MEM_ERROR;
     Tracev((stderr, "inflate: allocated\n"));
     strm->state = (struct internal_state FAR *)state;
+    state->strm = strm;
     state->window = Z_NULL;
+    state->mode = HEAD;     /* to pass state test in inflateReset2() */
     ret = inflateReset2(strm, windowBits);
     if (ret != Z_OK) {
         ZFREE(strm, state);
@@ -234,17 +252,17 @@ int value;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     if (bits < 0) {
         state->hold = 0;
         state->bits = 0;
         return Z_OK;
     }
-    if (bits > 16 || state->bits + bits > 32) return Z_STREAM_ERROR;
+    if (bits > 16 || state->bits + (uInt)bits > 32) return Z_STREAM_ERROR;
     value &= (1L << bits) - 1;
-    state->hold += value << state->bits;
-    state->bits += bits;
+    state->hold += (unsigned)value << state->bits;
+    state->bits += (uInt)bits;
     return Z_OK;
 }
 
@@ -430,10 +448,10 @@ unsigned copy;
 
 /* check function to use adler32() for zlib or crc32() for gzip */
 #ifdef GUNZIP
-#  define UPDATE(check, buf, len) \
+#  define UPDATE_CHECK(check, buf, len) \
     (state->flags ? crc32(check, buf, len) : adler32(check, buf, len))
 #else
-#  define UPDATE(check, buf, len) adler32(check, buf, len)
+#  define UPDATE_CHECK(check, buf, len) adler32(check, buf, len)
 #endif
 
 /* check macros for header crc */
@@ -625,7 +643,7 @@ int flush;
     static const unsigned short order[19] = /* permutation of code lengths */
         {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
 
-    if (strm == Z_NULL || strm->state == Z_NULL || strm->next_out == Z_NULL ||
+    if (inflateStateCheck(strm) || strm->next_out == Z_NULL ||
         (strm->next_in == Z_NULL && strm->avail_in != 0))
         return Z_STREAM_ERROR;
 
@@ -645,13 +663,14 @@ int flush;
             NEEDBITS(16);
 #ifdef GUNZIP
             if ((state->wrap & 2) && hold == 0x8b1f) {  /* gzip header */
+                if (state->wbits == 0)
+                    state->wbits = 15;
                 state->check = crc32(0L, Z_NULL, 0);
                 CRC2(state->check, hold);
                 INITBITS();
                 state->mode = FLAGS;
                 break;
             }
-            state->flags = 0;           /* expect zlib header */
             if (state->head != Z_NULL)
                 state->head->done = -1;
             if (!(state->wrap & 1) ||   /* check if zlib header allowed */
@@ -672,12 +691,13 @@ int flush;
             len = BITS(4) + 8;
             if (state->wbits == 0)
                 state->wbits = len;
-            else if (len > state->wbits) {
+            if (len > 15 || len > state->wbits) {
                 strm->msg = (char *)"invalid window size";
                 state->mode = BAD;
                 break;
             }
             state->dmax = 1U << len;
+            state->flags = 0;               /* indicate zlib header */
             Tracev((stderr, "inflate:   zlib header ok\n"));
             strm->adler = state->check = adler32(0L, Z_NULL, 0);
             state->mode = hold & 0x200 ? DICTID : TYPE;
@@ -699,37 +719,45 @@ int flush;
             }
             if (state->head != Z_NULL)
                 state->head->text = (int)((hold >> 8) & 1);
-            if (state->flags & 0x0200) CRC2(state->check, hold);
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC2(state->check, hold);
             INITBITS();
             state->mode = TIME;
+                /* fallthrough */
         case TIME:
             NEEDBITS(32);
             if (state->head != Z_NULL)
                 state->head->time = hold;
-            if (state->flags & 0x0200) CRC4(state->check, hold);
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC4(state->check, hold);
             INITBITS();
             state->mode = OS;
+                /* fallthrough */
         case OS:
             NEEDBITS(16);
             if (state->head != Z_NULL) {
                 state->head->xflags = (int)(hold & 0xff);
                 state->head->os = (int)(hold >> 8);
             }
-            if (state->flags & 0x0200) CRC2(state->check, hold);
+            if ((state->flags & 0x0200) && (state->wrap & 4))
+                CRC2(state->check, hold);
             INITBITS();
             state->mode = EXLEN;
+                /* fallthrough */
         case EXLEN:
             if (state->flags & 0x0400) {
                 NEEDBITS(16);
                 state->length = (unsigned)(hold);
                 if (state->head != Z_NULL)
                     state->head->extra_len = (unsigned)hold;
-                if (state->flags & 0x0200) CRC2(state->check, hold);
+                if ((state->flags & 0x0200) && (state->wrap & 4))
+                    CRC2(state->check, hold);
                 INITBITS();
             }
             else if (state->head != Z_NULL)
                 state->head->extra = Z_NULL;
             state->mode = EXTRA;
+                /* fallthrough */
         case EXTRA:
             if (state->flags & 0x0400) {
                 copy = state->length;
@@ -742,7 +770,7 @@ int flush;
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);
                     }
-                    if (state->flags & 0x0200)
+                    if ((state->flags & 0x0200) && (state->wrap & 4))
                         state->check = crc32(state->check, next, copy);
                     have -= copy;
                     next += copy;
@@ -752,6 +780,7 @@ int flush;
             }
             state->length = 0;
             state->mode = NAME;
+                /* fallthrough */
         case NAME:
             if (state->flags & 0x0800) {
                 if (have == 0) goto inf_leave;
@@ -761,9 +790,9 @@ int flush;
                     if (state->head != Z_NULL &&
                             state->head->name != Z_NULL &&
                             state->length < state->head->name_max)
-                        state->head->name[state->length++] = len;
+                        state->head->name[state->length++] = (Bytef)len;
                 } while (len && copy < have);
-                if (state->flags & 0x0200)
+                if ((state->flags & 0x0200) && (state->wrap & 4))
                     state->check = crc32(state->check, next, copy);
                 have -= copy;
                 next += copy;
@@ -773,6 +802,7 @@ int flush;
                 state->head->name = Z_NULL;
             state->length = 0;
             state->mode = COMMENT;
+                /* fallthrough */
         case COMMENT:
             if (state->flags & 0x1000) {
                 if (have == 0) goto inf_leave;
@@ -782,9 +812,9 @@ int flush;
                     if (state->head != Z_NULL &&
                             state->head->comment != Z_NULL &&
                             state->length < state->head->comm_max)
-                        state->head->comment[state->length++] = len;
+                        state->head->comment[state->length++] = (Bytef)len;
                 } while (len && copy < have);
-                if (state->flags & 0x0200)
+                if ((state->flags & 0x0200) && (state->wrap & 4))
                     state->check = crc32(state->check, next, copy);
                 have -= copy;
                 next += copy;
@@ -793,10 +823,11 @@ int flush;
             else if (state->head != Z_NULL)
                 state->head->comment = Z_NULL;
             state->mode = HCRC;
+                /* fallthrough */
         case HCRC:
             if (state->flags & 0x0200) {
                 NEEDBITS(16);
-                if (hold != (state->check & 0xffff)) {
+                if ((state->wrap & 4) && hold != (state->check & 0xffff)) {
                     strm->msg = (char *)"header crc mismatch";
                     state->mode = BAD;
                     break;
@@ -816,6 +847,7 @@ int flush;
             strm->adler = state->check = ZSWAP32(hold);
             INITBITS();
             state->mode = DICT;
+                /* fallthrough */
         case DICT:
             if (state->havedict == 0) {
                 RESTORE();
@@ -823,8 +855,10 @@ int flush;
             }
             strm->adler = state->check = adler32(0L, Z_NULL, 0);
             state->mode = TYPE;
+                /* fallthrough */
         case TYPE:
             if (flush == Z_BLOCK || flush == Z_TREES) goto inf_leave;
+                /* fallthrough */
         case TYPEDO:
             if (state->last) {
                 BYTEBITS();
@@ -875,8 +909,10 @@ int flush;
             INITBITS();
             state->mode = COPY_;
             if (flush == Z_TREES) goto inf_leave;
+                /* fallthrough */
         case COPY_:
             state->mode = COPY;
+                /* fallthrough */
         case COPY:
             copy = state->length;
             if (copy) {
@@ -912,6 +948,7 @@ int flush;
             Tracev((stderr, "inflate:       table sizes ok\n"));
             state->have = 0;
             state->mode = LENLENS;
+                /* fallthrough */
         case LENLENS:
             while (state->have < state->ncode) {
                 NEEDBITS(3);
@@ -933,6 +970,7 @@ int flush;
             Tracev((stderr, "inflate:       code lengths ok\n"));
             state->have = 0;
             state->mode = CODELENS;
+                /* fallthrough */
         case CODELENS:
             while (state->have < state->nlen + state->ndist) {
                 for (;;) {
@@ -1016,8 +1054,10 @@ int flush;
             Tracev((stderr, "inflate:       codes ok\n"));
             state->mode = LEN_;
             if (flush == Z_TREES) goto inf_leave;
+                /* fallthrough */
         case LEN_:
             state->mode = LEN;
+                /* fallthrough */
         case LEN:
             if (have >= 6 && left >= 258) {
                 RESTORE();
@@ -1067,6 +1107,7 @@ int flush;
             }
             state->extra = (unsigned)(here.op) & 15;
             state->mode = LENEXT;
+                /* fallthrough */
         case LENEXT:
             if (state->extra) {
                 NEEDBITS(state->extra);
@@ -1077,6 +1118,7 @@ int flush;
             Tracevv((stderr, "inflate:         length %u\n", state->length));
             state->was = state->length;
             state->mode = DIST;
+                /* fallthrough */
         case DIST:
             for (;;) {
                 here = state->distcode[BITS(state->distbits)];
@@ -1104,6 +1146,7 @@ int flush;
             state->offset = (unsigned)here.val;
             state->extra = (unsigned)(here.op) & 15;
             state->mode = DISTEXT;
+                /* fallthrough */
         case DISTEXT:
             if (state->extra) {
                 NEEDBITS(state->extra);
@@ -1120,6 +1163,7 @@ int flush;
 #endif
             Tracevv((stderr, "inflate:         distance %u\n", state->offset));
             state->mode = MATCH;
+                /* fallthrough */
         case MATCH:
             if (left == 0) goto inf_leave;
             copy = out - left;
@@ -1177,11 +1221,11 @@ int flush;
                 out -= left;
                 strm->total_out += out;
                 state->total += out;
-                if (out)
+                if ((state->wrap & 4) && out)
                     strm->adler = state->check =
-                        UPDATE(state->check, put - out, out);
+                        UPDATE_CHECK(state->check, put - out, out);
                 out = left;
-                if ((
+                if ((state->wrap & 4) && (
 #ifdef GUNZIP
                      state->flags ? hold :
 #endif
@@ -1195,10 +1239,11 @@ int flush;
             }
 #ifdef GUNZIP
             state->mode = LENGTH;
+                /* fallthrough */
         case LENGTH:
             if (state->wrap && state->flags) {
                 NEEDBITS(32);
-                if (hold != (state->total & 0xffffffffUL)) {
+                if ((state->wrap & 4) && hold != (state->total & 0xffffffff)) {
                     strm->msg = (char *)"incorrect length check";
                     state->mode = BAD;
                     break;
@@ -1208,6 +1253,7 @@ int flush;
             }
 #endif
             state->mode = DONE;
+                /* fallthrough */
         case DONE:
             ret = Z_STREAM_END;
             goto inf_leave;
@@ -1217,6 +1263,7 @@ int flush;
         case MEM:
             return Z_MEM_ERROR;
         case SYNC:
+                /* fallthrough */
         default:
             return Z_STREAM_ERROR;
         }
@@ -1240,10 +1287,10 @@ int flush;
     strm->total_in += in;
     strm->total_out += out;
     state->total += out;
-    if (state->wrap && out)
+    if ((state->wrap & 4) && out)
         strm->adler = state->check =
-            UPDATE(state->check, strm->next_out - out, out);
-    strm->data_type = state->bits + (state->last ? 64 : 0) +
+            UPDATE_CHECK(state->check, strm->next_out - out, out);
+    strm->data_type = (int)state->bits + (state->last ? 64 : 0) +
                       (state->mode == TYPE ? 128 : 0) +
                       (state->mode == LEN_ || state->mode == COPY_ ? 256 : 0);
     if (((in == 0 && out == 0) || flush == Z_FINISH) && ret == Z_OK)
@@ -1255,7 +1302,7 @@ int ZEXPORT inflateEnd(strm)
 z_streamp strm;
 {
     struct inflate_state FAR *state;
-    if (strm == Z_NULL || strm->state == Z_NULL || strm->zfree == (free_func)0)
+    if (inflateStateCheck(strm))
         return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     if (state->window != Z_NULL) ZFREE(strm, state->window);
@@ -1273,7 +1320,7 @@ uInt *dictLength;
     struct inflate_state FAR *state;
 
     /* check state */
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
 
     /* copy dictionary */
@@ -1298,7 +1345,7 @@ uInt dictLength;
     int ret;
 
     /* check state */
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     if (state->wrap != 0 && state->mode != DICT)
         return Z_STREAM_ERROR;
@@ -1330,7 +1377,7 @@ gz_headerp head;
     struct inflate_state FAR *state;
 
     /* check state */
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     if ((state->wrap & 2) == 0) return Z_STREAM_ERROR;
 
@@ -1378,12 +1425,13 @@ int ZEXPORT inflateSync(strm)
 z_streamp strm;
 {
     unsigned len;               /* number of bytes to look at or looked at */
+    int flags;                  /* temporary to save header status */
     unsigned long in, out;      /* temporary to save total_in and total_out */
     unsigned char buf[4];       /* to restore bit buffer to byte string */
     struct inflate_state FAR *state;
 
     /* check parameters */
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR;
 
@@ -1410,9 +1458,15 @@ z_streamp strm;
 
     /* return no joy or set up to restart inflate() on a new block */
     if (state->have != 4) return Z_DATA_ERROR;
+    if (state->flags == -1)
+        state->wrap = 0;    /* if no header yet, treat as raw */
+    else
+        state->wrap &= ~4;  /* no point in computing a check value now */
+    flags = state->flags;
     in = strm->total_in;  out = strm->total_out;
     inflateReset(strm);
     strm->total_in = in;  strm->total_out = out;
+    state->flags = flags;
     state->mode = TYPE;
     return Z_OK;
 }
@@ -1430,7 +1484,7 @@ z_streamp strm;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
     return state->mode == STORED && state->bits == 0;
 }
@@ -1445,8 +1499,7 @@ z_streamp source;
     unsigned wsize;
 
     /* check input */
-    if (dest == Z_NULL || source == Z_NULL || source->state == Z_NULL ||
-        source->zalloc == (alloc_func)0 || source->zfree == (free_func)0)
+    if (inflateStateCheck(source) || dest == Z_NULL)
         return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)source->state;
 
@@ -1467,6 +1520,7 @@ z_streamp source;
     /* copy state */
     zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream));
     zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state));
+    copy->strm = dest;
     if (state->lencode >= state->codes &&
         state->lencode <= state->codes + ENOUGH - 1) {
         copy->lencode = copy->codes + (state->lencode - state->codes);
@@ -1488,26 +1542,51 @@ int subvert;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
     state = (struct inflate_state FAR *)strm->state;
-    state->sane = !subvert;
 #ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
+    state->sane = !subvert;
     return Z_OK;
 #else
+    (void)subvert;
     state->sane = 1;
     return Z_DATA_ERROR;
 #endif
 }
 
+int ZEXPORT inflateValidate(strm, check)
+z_streamp strm;
+int check;
+{
+    struct inflate_state FAR *state;
+
+    if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
+    state = (struct inflate_state FAR *)strm->state;
+    if (check && state->wrap)
+        state->wrap |= 4;
+    else
+        state->wrap &= ~4;
+    return Z_OK;
+}
+
 long ZEXPORT inflateMark(strm)
 z_streamp strm;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL)
-        return (long)(((unsigned long)0 - 1) << 16);
+    if (inflateStateCheck(strm))
+        return -(1L << 16);
     state = (struct inflate_state FAR *)strm->state;
     return (long)(((unsigned long)((long)state->back)) << 16) +
         (state->mode == COPY ? state->length :
             (state->mode == MATCH ? state->was - state->length : 0));
 }
+
+unsigned long ZEXPORT inflateCodesUsed(strm)
+z_streamp strm;
+{
+    struct inflate_state FAR *state;
+    if (inflateStateCheck(strm)) return (unsigned long)-1;
+    state = (struct inflate_state FAR *)strm->state;
+    return (unsigned long)(state->next - state->codes);
+}

modules/zlib/src/inflate.h

@@ -1,5 +1,5 @@
 /* inflate.h -- internal inflate state definition
- * Copyright (C) 1995-2009 Mark Adler
+ * Copyright (C) 1995-2019 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -18,7 +18,7 @@
 
 /* Possible inflate modes between inflate() calls */
 typedef enum {
-    HEAD,       /* i: waiting for magic header */
+    HEAD = 16180,   /* i: waiting for magic header */
     FLAGS,      /* i: waiting for method and flags (gzip) */
     TIME,       /* i: waiting for modification time (gzip) */
     OS,         /* i: waiting for extra flags and operating system (gzip) */
@@ -77,13 +77,17 @@ typedef enum {
         CHECK -> LENGTH -> DONE
  */
 
-/* state maintained between inflate() calls.  Approximately 10K bytes. */
+/* State maintained between inflate() calls -- approximately 7K bytes, not
+   including the allocated sliding window, which is up to 32K bytes. */
 struct inflate_state {
+    z_streamp strm;             /* pointer back to this zlib stream */
     inflate_mode mode;          /* current inflate mode */
     int last;                   /* true if processing last block */
-    int wrap;                   /* bit 0 true for zlib, bit 1 true for gzip */
+    int wrap;                   /* bit 0 true for zlib, bit 1 true for gzip,
+                                   bit 2 true to validate check value */
     int havedict;               /* true if dictionary provided */
-    int flags;                  /* gzip header method and flags (0 if zlib) */
+    int flags;                  /* gzip header method and flags, 0 if zlib, or
+                                   -1 if raw or no header yet */
     unsigned dmax;              /* zlib header max distance (INFLATE_STRICT) */
     unsigned long check;        /* protected copy of check value */
     unsigned long total;        /* protected copy of output count */